refactor(P0): JWT 认证、并发安全、错误日志三项安全加固

- 新增 JWT httpOnly cookie 认证链路 (jose)，登录/注册签发 token，
  所有用户和盲盒 API 改为从 cookie 提取 userId，不再信任客户端传值
- 新增 /api/auth/logout 端点清除认证 cookie
- GET /api/user 区分 owner/非 owner，非 owner 不暴露 email
- atomicUpdateRoom 新增 per-room 应用层互斥锁，防止 SQLite 下并发 lost update
- 修复 getRoomData 中 fire-and-forget delete 改为 await
- 37 个静默 catch 块跨 17 个文件添加 console.error 日志
- 新增 REFACTOR_PLAN.md 全景分析文档

src/app/api/user/route.ts

@@ -2,17 +2,29 @@ import { NextResponse } from "next/server";
 import { prisma } from "@/lib/prisma";
 import { Prisma } from "@prisma/client";
 import bcrypt from "bcryptjs";
-import { apiHandler, ApiError, requireUserId, requireUser } from "@/lib/api";
+import { apiHandler, ApiError, requireUser } from "@/lib/api";
 import { validateUsername, validatePassword, validateEmail } from "@/lib/validation";
+import { getAuthUserId } from "@/lib/auth";
 
 export const GET = apiHandler(async (req) => {
-  const userId = req.nextUrl.searchParams.get("id");
-  if (!userId) return NextResponse.json(null);
+  // GET still allows querying by id param (for public profile viewing)
+  // but sensitive fields are only shown to the owner
+  const queryId = req.nextUrl.searchParams.get("id");
+  if (!queryId) return NextResponse.json(null);
 
-  const user = await prisma.user.findUnique({ where: { id: userId } });
+  const user = await prisma.user.findUnique({ where: { id: queryId } });
   if (!user) return NextResponse.json(null);
 
-  const decisionCount = await prisma.decision.count({ where: { userId } });
+  const decisionCount = await prisma.decision.count({ where: { userId: queryId } });
+
+  // Check if the requester is the profile owner
+  let isOwner = false;
+  try {
+    const authId = await getAuthUserId(req);
+    isOwner = authId === queryId;
+  } catch {
+    // Not logged in — show public profile only
+  }
 
   let preferences = {};
   try { preferences = JSON.parse(user.preferences); } catch { /* fallback */ }
@@ -21,18 +33,17 @@ export const GET = apiHandler(async (req) => {
     id: user.id,
     username: user.username,
     avatar: user.avatar,
-    email: user.email,
-    preferences,
+    email: isOwner ? user.email : undefined,
+    preferences: isOwner ? preferences : undefined,
     createdAt: user.createdAt.toISOString(),
     decisionCount,
   });
 });
 
 export const PUT = apiHandler(async (req) => {
+  const userId = await getAuthUserId(req);
   const body = await req.json();
-  const { userId } = body;
 
-  requireUserId(userId);
   const existing = await requireUser(userId);
 
   const updateData: Record<string, unknown> = {};