fix: SSE 认证 + 收藏去重 + 数据库索引和级联删除

- #7: SSE events 接口校验 userId 房间成员身份，start() 加 try/catch
- #9: Favorite 新增 restaurantId 字段做精确去重，不再用 JSON contains
- #10: 补齐 Decision/Favorite/Room/BlindBoxIdea 缺失索引
- #11: Decision/Favorite/BlindBoxMember/BlindBoxIdea 加 onDelete Cascade

src/app/api/room/[id]/events/route.ts

@@ -1,4 +1,5 @@
 import { buildRoomStatus } from "@/lib/buildRoomStatus";
+import { getRoomData } from "@/lib/store";
 import { subscribe } from "@/lib/roomEvents";
 
 export const dynamic = "force-dynamic";
@@ -9,6 +10,19 @@ export async function GET(
 ) {
   const { id } = await params;
 
+  const url = new URL(req.url);
+  const userId = url.searchParams.get("userId");
+
+  if (userId) {
+    const data = await getRoomData(id);
+    if (data && !data.users.includes(userId)) {
+      return new Response(JSON.stringify({ error: "not_a_member" }), {
+        status: 403,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+  }
+
   const encoder = new TextEncoder();
 
   const stream = new ReadableStream({
@@ -26,13 +40,18 @@ export async function GET(
       let alive = true;
 
       (async () => {
-        const status = await buildRoomStatus(id);
-        if (!status) {
-          send({ error: "room_not_found" });
+        try {
+          const status = await buildRoomStatus(id);
+          if (!status) {
+            send({ error: "room_not_found" });
+            controller.close();
+            return;
+          }
+          if (alive) send(status);
+        } catch {
+          send({ error: "load_failed" });
           controller.close();
-          return;
         }
-        if (alive) send(status);
       })();
 
       const unsubscribe = subscribe(id, async () => {