refactor: 代码质量优化与安全修复

- 删除根目录重复的 server.js (830行)，统一使用模块化的 server/index.js
- 修复 ESLint 错误: 移除未使用变量、修复 const 声明、处理未使用参数
- 修复 React Hooks 依赖警告: 使用 useCallback 包装函数并添加正确依赖项
- SQL LIKE 查询添加特殊字符转义，防止注入风险
- 移除 CSS 中重复的 @keyframes spin 定义

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/routes/search.js

@@ -5,6 +5,11 @@ const { asyncHandler, AppError } = require('../middleware/errorHandler');
 
 const router = express.Router();
 
+// 转义 SQL LIKE 特殊字符
+function escapeLikePattern(str) {
+  return str.replace(/[%_\\]/g, '\\$&');
+}
+
 // 搜索账目
 router.get('/', authenticate, asyncHandler(async (req, res) => {
   const { q } = req.query;
@@ -13,14 +18,15 @@ router.get('/', authenticate, asyncHandler(async (req, res) => {
     throw new AppError('请输入搜索关键词', 400, 'MISSING_QUERY');
   }
 
+  const escapedQ = escapeLikePattern(q);
   const stmt = db.prepare(`
     SELECT * FROM records
-    WHERE user_id = ? AND (category LIKE ? OR note LIKE ?)
+    WHERE user_id = ? AND (category LIKE ? ESCAPE '\\' OR note LIKE ? ESCAPE '\\')
     ORDER BY date DESC, id DESC
     LIMIT 50
   `);
 
-  const records = stmt.all(req.userId, `%${q}%`, `%${q}%`);
+  const records = stmt.all(req.userId, `%${escapedQ}%`, `%${escapedQ}%`);
   res.json(records);
 }));