fix: 房间 swipe/undo/reset 接口添加成员身份校验

- swipe/undo：校验 userId 在 data.users 中，非成员返回 403
- reset：要求传 userId，校验为房间成员或创建者
- 客户端 handleReset/handleNarrow 传入 userId

src/app/api/room/[id]/swipe/route.ts

@@ -15,6 +15,10 @@ export const POST = apiHandler(async (req, { params }) => {
   const rid = String(restaurantId);
 
   const updated = await atomicUpdateRoom(id, (data) => {
+    if (!data.users.includes(userId)) {
+      throw new ApiError("你不是该房间的成员", 403);
+    }
+
     const restaurantIndex = data.restaurants.findIndex((r) => r.id === rid);
     const alreadySwiped =
       restaurantIndex >= 0 &&