refactor(P0): JWT 认证、并发安全、错误日志三项安全加固

- 新增 JWT httpOnly cookie 认证链路 (jose)，登录/注册签发 token，
  所有用户和盲盒 API 改为从 cookie 提取 userId，不再信任客户端传值
- 新增 /api/auth/logout 端点清除认证 cookie
- GET /api/user 区分 owner/非 owner，非 owner 不暴露 email
- atomicUpdateRoom 新增 per-room 应用层互斥锁，防止 SQLite 下并发 lost update
- 修复 getRoomData 中 fire-and-forget delete 改为 await
- 37 个静默 catch 块跨 17 个文件添加 console.error 日志
- 新增 REFACTOR_PLAN.md 全景分析文档

src/app/api/user/favorite/route.ts

@@ -1,11 +1,11 @@
 import { NextResponse } from "next/server";
 import { prisma } from "@/lib/prisma";
 import { Prisma } from "@prisma/client";
-import { apiHandler, ApiError, requireUserId, requireUser } from "@/lib/api";
+import { apiHandler, ApiError, requireUser } from "@/lib/api";
+import { getAuthUserId } from "@/lib/auth";
 
 export const GET = apiHandler(async (req) => {
-  const userId = req.nextUrl.searchParams.get("userId");
-  if (!userId) return NextResponse.json([]);
+  const userId = await getAuthUserId(req);
 
   const favorites = await prisma.favorite.findMany({
     where: { userId },
@@ -23,9 +23,9 @@ export const GET = apiHandler(async (req) => {
 });
 
 export const POST = apiHandler(async (req) => {
-  const { userId, restaurant } = await req.json();
+  const userId = await getAuthUserId(req);
+  const { restaurant } = await req.json();
 
-  requireUserId(userId);
   if (!restaurant?.id || typeof restaurant.id !== "string") {
     throw new ApiError("缺少必要字段");
   }
@@ -53,9 +53,9 @@ export const POST = apiHandler(async (req) => {
 });
 
 export const DELETE = apiHandler(async (req) => {
-  const { userId, favoriteId } = await req.json();
+  const userId = await getAuthUserId(req);
+  const { favoriteId } = await req.json();
 
-  requireUserId(userId);
   if (!favoriteId) throw new ApiError("缺少必要字段");
 
   const fav = await prisma.favorite.findUnique({ where: { id: favoriteId } });