perf: add rate limiting, validation, logging, and error handling

- Add express-rate-limit with tiered rate limits per endpoint
- Add express-validator for input validation on all API routes
- Add winston + morgan for structured logging
- Add node-cache for lottery result caching (5min TTL, 1000 max keys)
- Convert OCR to async task queue with max 2 concurrent jobs
- Add global error handler middleware
- Add React ErrorBoundary for client-side error handling
- Fix memory leaks in OCR task queue and lottery cache
- Add per-item error handling in batch ticket updates
- Fix SQL UPDATE to include user_id in WHERE clause

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/routes/lottery.js

@@ -2,25 +2,23 @@ const express = require('express');
 const db = require('../db/init');
 const { authMiddleware } = require('../middleware/auth');
 const { fetchLotteryResult, updateTicketsStatus, getEstimatedDrawTime } = require('../services/lottery');
+const { refreshLimiter, standardLimiter } = require('../middleware/rateLimiter');
+const { validate, lotteryQueryRules } = require('../middleware/validate');
+const logger = require('../services/logger');
 
 const router = express.Router();
 
 router.use(authMiddleware);
 
 // 查询开奖结果
-router.get('/result', async (req, res) => {
+router.get('/result', lotteryQueryRules, validate, async (req, res) => {
   const { game, issue } = req.query;
 
-  if (!game || !issue) {
-    return res.status(400).json({ error: '请提供彩票类型和期号' });
-  }
-
   try {
     const result = await fetchLotteryResult(game, issue);
     if (result) {
       res.json(result);
     } else {
-      // 未开奖时返回预计开奖时间
       const estimatedTime = getEstimatedDrawTime(game, issue);
       res.json({
         message: '暂未开奖或未找到数据',
@@ -29,22 +27,25 @@ router.get('/result', async (req, res) => {
       });
     }
   } catch (err) {
+    logger.error('查询开奖结果失败', { game, issue, error: err.message });
     res.status(500).json({ error: '查询失败' });
   }
 });
 
 // 刷新用户所有待开奖彩票状态
-router.post('/refresh', async (req, res) => {
+router.post('/refresh', refreshLimiter, async (req, res) => {
   try {
     await updateTicketsStatus(req.user.id);
+    logger.info(`刷新开奖: userId=${req.user.id}`);
     res.json({ message: '刷新成功' });
   } catch (err) {
+    logger.error('刷新开奖失败', { error: err.message });
     res.status(500).json({ error: '刷新失败' });
   }
 });
 
 // 获取最近开奖记录
-router.get('/recent', async (req, res) => {
+router.get('/recent', standardLimiter, (req, res) => {
   const { game, limit = 10 } = req.query;
 
   let query = 'SELECT * FROM lottery_results';
@@ -58,8 +59,13 @@ router.get('/recent', async (req, res) => {
   query += ' ORDER BY draw_date DESC LIMIT ?';
   params.push(Number(limit));
 
-  const results = db.prepare(query).all(...params);
-  res.json(results.map(r => ({ ...r, numbers: JSON.parse(r.numbers) })));
+  try {
+    const results = db.prepare(query).all(...params);
+    res.json(results.map(r => ({ ...r, numbers: JSON.parse(r.numbers) })));
+  } catch (err) {
+    logger.error('获取最近开奖记录失败', { error: err.message });
+    res.status(500).json({ error: '查询失败' });
+  }
 });
 
 module.exports = router;