refactor: 系统优化 - 错误处理、输入验证、无限滚动

主要改进:
- 新增配置管理 (server/config.js)
- 新增日志工具 (server/utils/logger.js)
- 添加全局错误处理中间件，统一错误响应格式
- 添加输入验证和 AppError 错误类
- 重构 db.js 迁移逻辑，代码更清晰
- 前端列表改为无限滚动加载，每页 20 条
- 封装 AppState 状态管理模块

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

public/js/app.js

@@ -1,11 +1,62 @@
+// ============================================
+// 应用状态管理
+// ============================================
 const API = '';
-let token = localStorage.getItem('token');
-let username = localStorage.getItem('username');
-let currentType = 'income';
-let currentCategory = '接单';
-let currentYear = new Date().getFullYear();
-let currentMonth = new Date().getMonth() + 1;
-let currentNav = 'stats';
+
+const AppState = {
+  // 认证状态
+  auth: {
+    token: localStorage.getItem('token'),
+    username: localStorage.getItem('username')
+  },
+
+  // 导航状态
+  nav: {
+    currentType: 'income',
+    currentCategory: '接单',
+    currentYear: new Date().getFullYear(),
+    currentMonth: new Date().getMonth() + 1,
+    currentNav: 'stats'
+  },
+
+  // 状态更新方法
+  setAuth(token, username) {
+    this.auth.token = token;
+    this.auth.username = username;
+    localStorage.setItem('token', token);
+    localStorage.setItem('username', username);
+  },
+
+  clearAuth() {
+    this.auth.token = null;
+    this.auth.username = null;
+    localStorage.removeItem('token');
+    localStorage.removeItem('username');
+  },
+
+  setCategory(type, category) {
+    this.nav.currentType = type;
+    this.nav.currentCategory = category;
+  },
+
+  setYearMonth(year, month) {
+    this.nav.currentYear = year;
+    this.nav.currentMonth = month;
+  },
+
+  setNav(nav) {
+    this.nav.currentNav = nav;
+  }
+};
+
+// 兼容旧代码的全局变量
+let token = AppState.auth.token;
+let username = AppState.auth.username;
+let currentType = AppState.nav.currentType;
+let currentCategory = AppState.nav.currentCategory;
+let currentYear = AppState.nav.currentYear;
+let currentMonth = AppState.nav.currentMonth;
+let currentNav = AppState.nav.currentNav;
 
 function headers() {
   return { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + token };