fix: 房间 swipe/undo/reset 接口添加成员身份校验

- swipe/undo：校验 userId 在 data.users 中，非成员返回 403
- reset：要求传 userId，校验为房间成员或创建者
- 客户端 handleReset/handleNarrow 传入 userId

src/app/api/room/[id]/reset/route.ts

@@ -1,22 +1,25 @@
 import { NextResponse } from "next/server";
 import { atomicUpdateRoom } from "@/lib/store";
 import { notify } from "@/lib/roomEvents";
-import { apiHandler, ApiError } from "@/lib/api";
+import { apiHandler, ApiError, requireUserId } from "@/lib/api";
 
 export const POST = apiHandler(async (req, { params }) => {
   const { id } = await params;
 
+  const body = await req.json().catch(() => ({}));
+  const userId = body?.userId;
+  requireUserId(userId);
+
   let restaurantIds: string[] | undefined;
-  try {
-    const body = await req.json().catch(() => null);
-    if (body?.restaurantIds && Array.isArray(body.restaurantIds)) {
-      restaurantIds = body.restaurantIds;
-    }
-  } catch {
-    // No body or invalid JSON — plain reset
+  if (body?.restaurantIds && Array.isArray(body.restaurantIds)) {
+    restaurantIds = body.restaurantIds;
   }
 
   const updated = await atomicUpdateRoom(id, (data) => {
+    if (!data.users.includes(userId) && data.creatorId !== userId) {
+      throw new ApiError("只有房间成员可以重置", 403);
+    }
+
     if (restaurantIds && restaurantIds.length > 0) {
       const idSet = new Set(restaurantIds);
       data.restaurants = data.restaurants.filter((r) => idSet.has(r.id));