perf: add rate limiting, validation, logging, and error handling

- Add express-rate-limit with tiered rate limits per endpoint
- Add express-validator for input validation on all API routes
- Add winston + morgan for structured logging
- Add node-cache for lottery result caching (5min TTL, 1000 max keys)
- Convert OCR to async task queue with max 2 concurrent jobs
- Add global error handler middleware
- Add React ErrorBoundary for client-side error handling
- Fix memory leaks in OCR task queue and lottery cache
- Add per-item error handling in batch ticket updates
- Fix SQL UPDATE to include user_id in WHERE clause

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/middleware/errorHandler.js

@@ -0,0 +1,24 @@
+const logger = require('../services/logger');
+
+function errorHandler(err, req, res, next) {
+  logger.error('Unhandled error', {
+    error: err.message,
+    stack: err.stack,
+    path: req.path,
+    method: req.method,
+    ip: req.ip
+  });
+
+  if (err.type === 'entity.parse.failed') {
+    return res.status(400).json({ error: '无效的JSON格式' });
+  }
+
+  // express-validator 验证失败时直接返回400，不会抛到这里
+  // 此检查保留作为其他验证库的安全网
+
+  res.status(err.status || 500).json({
+    error: process.env.NODE_ENV === 'production' ? '服务器内部错误' : err.message
+  });
+}
+
+module.exports = errorHandler;