perf: add rate limiting, validation, logging, and error handling

- Add express-rate-limit with tiered rate limits per endpoint
- Add express-validator for input validation on all API routes
- Add winston + morgan for structured logging
- Add node-cache for lottery result caching (5min TTL, 1000 max keys)
- Convert OCR to async task queue with max 2 concurrent jobs
- Add global error handler middleware
- Add React ErrorBoundary for client-side error handling
- Fix memory leaks in OCR task queue and lottery cache
- Add per-item error handling in batch ticket updates
- Fix SQL UPDATE to include user_id in WHERE clause

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/routes/auth.js

@@ -2,17 +2,16 @@ const express = require('express');
 const bcrypt = require('bcryptjs');
 const db = require('../db/init');
 const { generateToken } = require('../middleware/auth');
+const { authLimiter } = require('../middleware/rateLimiter');
+const { validate, registerRules, loginRules } = require('../middleware/validate');
+const logger = require('../services/logger');
 
 const router = express.Router();
 
 // 注册
-router.post('/register', (req, res) => {
+router.post('/register', authLimiter, registerRules, validate, (req, res) => {
   const { username, password } = req.body;
 
-  if (!username || !password) {
-    return res.status(400).json({ error: '用户名和密码不能为空' });
-  }
-
   try {
     const hashedPassword = bcrypt.hashSync(password, 10);
     const stmt = db.prepare('INSERT INTO users (username, password) VALUES (?, ?)');
@@ -21,31 +20,31 @@ router.post('/register', (req, res) => {
     const user = { id: result.lastInsertRowid, username };
     const token = generateToken(user);
 
+    logger.info(`用户注册成功: ${username}`);
     res.json({ user, token });
   } catch (err) {
     if (err.code === 'SQLITE_CONSTRAINT_UNIQUE') {
       return res.status(400).json({ error: '用户名已存在' });
     }
+    logger.error('注册失败', { error: err.message });
     res.status(500).json({ error: '注册失败' });
   }
 });
 
 // 登录
-router.post('/login', (req, res) => {
+router.post('/login', authLimiter, loginRules, validate, (req, res) => {
   const { username, password } = req.body;
 
-  if (!username || !password) {
-    return res.status(400).json({ error: '用户名和密码不能为空' });
-  }
-
   const stmt = db.prepare('SELECT * FROM users WHERE username = ?');
   const user = stmt.get(username);
 
   if (!user || !bcrypt.compareSync(password, user.password)) {
+    logger.warn(`登录失败: ${username}`);
     return res.status(401).json({ error: '用户名或密码错误' });
   }
 
   const token = generateToken(user);
+  logger.info(`用户登录成功: ${username}`);
   res.json({ user: { id: user.id, username: user.username }, token });
 });