refactor: 提取 requireUserId/requireUser/requireMembership 校验工具

- 新增 requireUserId：统一 14 处 userId 非空校验，返回 401
- 新增 requireUser：统一 4 处用户存在性检查，返回 404
- validateMembership 升级为 requireMembership，直接抛 403
- 混合校验拆分为 auth(401) + 字段(400)，状态码更准确

src/app/api/room/[id]/join/route.ts

@@ -1,13 +1,13 @@
 import { NextResponse } from "next/server";
 import { atomicUpdateRoom } from "@/lib/store";
 import { notify } from "@/lib/roomEvents";
-import { apiHandler, ApiError } from "@/lib/api";
+import { apiHandler, ApiError, requireUserId } from "@/lib/api";
 
 export const POST = apiHandler(async (req, { params }) => {
   const { id } = await params;
   const { userId } = await req.json();
 
-  if (!userId) throw new ApiError("userId required");
+  requireUserId(userId);
 
   const updated = await atomicUpdateRoom(id, (data) => {
     if (data.kickedUsers.includes(userId)) {

src/app/api/room/[id]/manage/route.ts

@@ -1,15 +1,14 @@
 import { NextResponse } from "next/server";
 import { atomicUpdateRoom } from "@/lib/store";
 import { notify } from "@/lib/roomEvents";
-import { apiHandler, ApiError } from "@/lib/api";
+import { apiHandler, ApiError, requireUserId } from "@/lib/api";
 
 export const POST = apiHandler(async (req, { params }) => {
   const { id } = await params;
   const { userId, action, targetUserId } = await req.json();
 
-  if (!userId || !action) {
-    throw new ApiError("userId and action required");
-  }
+  requireUserId(userId);
+  if (!action) throw new ApiError("action required");
 
   const updated = await atomicUpdateRoom(id, (data) => {
     if (data.creatorId !== userId) {

src/app/api/room/[id]/swipe/route.ts

@@ -1,14 +1,15 @@
 import { NextResponse } from "next/server";
 import { atomicUpdateRoom } from "@/lib/store";
 import { notify } from "@/lib/roomEvents";
-import { apiHandler, ApiError } from "@/lib/api";
+import { apiHandler, ApiError, requireUserId } from "@/lib/api";
 
 export const POST = apiHandler(async (req, { params }) => {
   const { id } = await params;
   const { userId, restaurantId, action } = await req.json();
 
-  if (!userId || restaurantId == null || !action) {
-    throw new ApiError("userId, restaurantId, and action are required");
+  requireUserId(userId);
+  if (restaurantId == null || !action) {
+    throw new ApiError("restaurantId and action are required");
   }
 
   const rid = String(restaurantId);

src/app/api/room/[id]/undo/route.ts

@@ -1,15 +1,14 @@
 import { NextResponse } from "next/server";
 import { atomicUpdateRoom } from "@/lib/store";
 import { notify } from "@/lib/roomEvents";
-import { apiHandler, ApiError } from "@/lib/api";
+import { apiHandler, ApiError, requireUserId } from "@/lib/api";
 
 export const POST = apiHandler(async (req, { params }) => {
   const { id } = await params;
   const { userId, restaurantId } = await req.json();
 
-  if (!userId || restaurantId == null) {
-    throw new ApiError("userId and restaurantId are required");
-  }
+  requireUserId(userId);
+  if (restaurantId == null) throw new ApiError("restaurantId is required");
 
   const rid = String(restaurantId);