feat: 盲盒房间体系重构 — 强制登录、独立房间、用户归属

- 新增 BlindBoxRoom/BlindBoxMember 模型，BlindBoxIdea 增加 userId/drawnById
- 新增房间 API（创建/加入/列表/详情），所有盲盒 API 增加认证和成员校验
- 新建盲盒大厅页面（三层引导式设计：未登录氛围页/首次创建引导/房间列表）
- 新建盲盒房间页面（成员校验/邀请分享/用户归属展示/自动聚焦）
- 首页删除契约画廊和 localStorage 盲盒逻辑，周末契约跳转到 /blindbox
- 清理旧路由 /room/[id]/blindbox
- 提取共享工具 src/lib/blindbox.ts（错误响应/房间号生成/成员校验）
- AuthModal 支持 defaultTab 参数
- 更新项目规范：新项目原则、代码优雅和复用优先

src/app/api/blindbox/draw/route.ts

@@ -1,39 +1,51 @@
 import { NextRequest, NextResponse } from "next/server";
 import { prisma } from "@/lib/prisma";
+import { errorResponse, validateMembership } from "@/lib/blindbox";
 
 export async function POST(req: NextRequest) {
   try {
-    const { roomId } = await req.json();
+    const { roomId, userId } = await req.json();
 
+    if (!userId || typeof userId !== "string") {
+      return errorResponse("请先登录", 401);
+    }
     if (!roomId || typeof roomId !== "string") {
-      return NextResponse.json({ error: "roomId 不能为空" }, { status: 400 });
+      return errorResponse("roomId 不能为空", 400);
+    }
+
+    const isMember = await validateMembership(roomId, userId);
+    if (!isMember) {
+      return errorResponse("你不是这个房间的成员", 403);
     }
 
     const pool = await prisma.blindBoxIdea.findMany({
-      where: { roomId: roomId.trim(), status: "in_pool" },
+      where: { roomId, status: "in_pool" },
       select: { id: true },
     });
 
     if (pool.length === 0) {
-      return NextResponse.json(
-        { error: "盒子是空的，先往里面塞点想法吧！" },
-        { status: 404 },
-      );
+      return errorResponse("盒子是空的，先往里面塞点想法吧！", 404);
     }
 
     const picked = pool[Math.floor(Math.random() * pool.length)];
 
     const idea = await prisma.blindBoxIdea.update({
       where: { id: picked.id },
-      data: { status: "drawn" },
+      data: { status: "drawn", drawnById: userId },
+      include: {
+        user: { select: { id: true, username: true, avatar: true } },
+        drawnBy: { select: { id: true, username: true, avatar: true } },
+      },
     });
 
     return NextResponse.json({
       id: idea.id,
       content: idea.content,
       createdAt: idea.createdAt,
+      submitter: idea.user,
+      drawnBy: idea.drawnBy,
     });
   } catch {
-    return NextResponse.json({ error: "抽取失败" }, { status: 500 });
+    return errorResponse("抽取失败", 500);
   }
 }