perf: add rate limiting, validation, logging, and error handling

- Add express-rate-limit with tiered rate limits per endpoint
- Add express-validator for input validation on all API routes
- Add winston + morgan for structured logging
- Add node-cache for lottery result caching (5min TTL, 1000 max keys)
- Convert OCR to async task queue with max 2 concurrent jobs
- Add global error handler middleware
- Add React ErrorBoundary for client-side error handling
- Fix memory leaks in OCR task queue and lottery cache
- Add per-item error handling in batch ticket updates
- Fix SQL UPDATE to include user_id in WHERE clause

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/routes/ocr.js

@@ -3,7 +3,9 @@ const multer = require('multer');
 const path = require('path');
 const fs = require('fs');
 const { authMiddleware } = require('../middleware/auth');
-const { parseTicketImage } = require('../services/ocr');
+const { parseTicketImage, getOCRResult } = require('../services/ocr');
+const { ocrLimiter } = require('../middleware/rateLimiter');
+const logger = require('../services/logger');
 
 const router = express.Router();
 
@@ -25,7 +27,6 @@ const upload = multer({
   storage,
   limits: { fileSize: 10 * 1024 * 1024 },
   fileFilter: (req, file, cb) => {
-    // 放宽图片类型限制
     if (file.mimetype.startsWith('image/')) {
       cb(null, true);
     } else {
@@ -36,18 +37,49 @@ const upload = multer({
 
 router.use(authMiddleware);
 
-// 上传并解析彩票图片
-router.post('/parse', upload.single('image'), async (req, res) => {
+// 上传并解析彩票图片 (改为异步)
+router.post('/parse', ocrLimiter, upload.single('image'), (req, res) => {
   if (!req.file) {
     return res.status(400).json({ error: '请上传图片' });
   }
 
   try {
-    const result = await parseTicketImage(req.file.path);
-    result.image_path = `/uploads/${req.file.filename}`;
-    res.json(result);
+    const { taskId } = parseTicketImage(req.file.path);
+    logger.info(`OCR任务已提交: ${taskId}`);
+    res.json({ taskId, status: 'processing', message: '图片已提交处理，请稍后查询结果' });
   } catch (err) {
-    res.status(500).json({ error: err.message || '解析失败' });
+    logger.error('OCR提交失败', { error: err.message });
+    res.status(500).json({ error: err.message || '提交失败' });
+  }
+});
+
+// 查询OCR结果
+router.get('/result/:taskId', (req, res) => {
+  const { taskId } = req.params;
+
+  if (!taskId || !taskId.startsWith('ocr_')) {
+    return res.status(400).json({ error: '无效的任务ID' });
+  }
+
+  try {
+    const result = getOCRResult(taskId);
+
+    if (result.completed) {
+      if (result.success) {
+        res.json({
+          status: 'completed',
+          ...result.data
+          // image_path 在提交时由客户端记录，此处无需返回
+        });
+      } else {
+        res.status(500).json({ status: 'failed', error: result.error });
+      }
+    } else {
+      res.json({ status: result.processing ? 'processing' : 'pending', taskId });
+    }
+  } catch (err) {
+    logger.error('OCR结果查询失败', { taskId, error: err.message });
+    res.status(500).json({ error: '查询失败' });
   }
 });