feat: 盲盒房间体系重构 — 强制登录、独立房间、用户归属

- 新增 BlindBoxRoom/BlindBoxMember 模型，BlindBoxIdea 增加 userId/drawnById
- 新增房间 API（创建/加入/列表/详情），所有盲盒 API 增加认证和成员校验
- 新建盲盒大厅页面（三层引导式设计：未登录氛围页/首次创建引导/房间列表）
- 新建盲盒房间页面（成员校验/邀请分享/用户归属展示/自动聚焦）
- 首页删除契约画廊和 localStorage 盲盒逻辑，周末契约跳转到 /blindbox
- 清理旧路由 /room/[id]/blindbox
- 提取共享工具 src/lib/blindbox.ts（错误响应/房间号生成/成员校验）
- AuthModal 支持 defaultTab 参数
- 更新项目规范：新项目原则、代码优雅和复用优先

src/app/api/blindbox/route.ts

@@ -1,50 +1,76 @@
 import { NextRequest, NextResponse } from "next/server";
 import { prisma } from "@/lib/prisma";
+import { errorResponse, validateMembership } from "@/lib/blindbox";
 
 export async function POST(req: NextRequest) {
   try {
-    const { roomId, content } = await req.json();
+    const { roomId, userId, content } = await req.json();
 
+    if (!userId || typeof userId !== "string") {
+      return errorResponse("请先登录", 401);
+    }
     if (!roomId || typeof roomId !== "string") {
-      return NextResponse.json({ error: "roomId 不能为空" }, { status: 400 });
+      return errorResponse("roomId 不能为空", 400);
     }
     if (!content || typeof content !== "string" || content.trim().length === 0) {
-      return NextResponse.json({ error: "内容不能为空" }, { status: 400 });
+      return errorResponse("内容不能为空", 400);
     }
     if (content.trim().length > 200) {
-      return NextResponse.json({ error: "内容不能超过 200 字" }, { status: 400 });
+      return errorResponse("内容不能超过 200 字", 400);
+    }
+
+    const isMember = await validateMembership(roomId, userId);
+    if (!isMember) {
+      return errorResponse("你不是这个房间的成员", 403);
     }
 
     const idea = await prisma.blindBoxIdea.create({
       data: {
-        roomId: roomId.trim(),
+        roomId,
+        userId,
         content: content.trim(),
       },
     });
 
     return NextResponse.json({ id: idea.id }, { status: 201 });
   } catch {
-    return NextResponse.json({ error: "提交失败" }, { status: 500 });
+    return errorResponse("提交失败", 500);
   }
 }
 
 export async function GET(req: NextRequest) {
   const roomId = req.nextUrl.searchParams.get("roomId");
+  const userId = req.nextUrl.searchParams.get("userId");
 
   if (!roomId) {
-    return NextResponse.json({ error: "缺少 roomId" }, { status: 400 });
+    return errorResponse("缺少 roomId", 400);
+  }
+  if (!userId) {
+    return errorResponse("请先登录", 401);
   }
 
-  const [poolCount, drawn] = await Promise.all([
-    prisma.blindBoxIdea.count({
-      where: { roomId, status: "in_pool" },
-    }),
-    prisma.blindBoxIdea.findMany({
-      where: { roomId, status: "drawn" },
-      orderBy: { createdAt: "desc" },
-      select: { id: true, content: true, createdAt: true },
-    }),
-  ]);
+  const isMember = await validateMembership(roomId, userId);
+  if (!isMember) {
+    return errorResponse("你不是这个房间的成员", 403);
+  }
 
-  return NextResponse.json({ poolCount, drawn });
+  try {
+    const [poolCount, drawn] = await Promise.all([
+      prisma.blindBoxIdea.count({
+        where: { roomId, status: "in_pool" },
+      }),
+      prisma.blindBoxIdea.findMany({
+        where: { roomId, status: "drawn" },
+        orderBy: { createdAt: "desc" },
+        include: {
+          user: { select: { id: true, username: true, avatar: true } },
+          drawnBy: { select: { id: true, username: true, avatar: true } },
+        },
+      }),
+    ]);
+
+    return NextResponse.json({ poolCount, drawn });
+  } catch {
+    return errorResponse("查询失败", 500);
+  }
 }