refactor(P0): JWT 认证、并发安全、错误日志三项安全加固

- 新增 JWT httpOnly cookie 认证链路 (jose)，登录/注册签发 token，
  所有用户和盲盒 API 改为从 cookie 提取 userId，不再信任客户端传值
- 新增 /api/auth/logout 端点清除认证 cookie
- GET /api/user 区分 owner/非 owner，非 owner 不暴露 email
- atomicUpdateRoom 新增 per-room 应用层互斥锁，防止 SQLite 下并发 lost update
- 修复 getRoomData 中 fire-and-forget delete 改为 await
- 37 个静默 catch 块跨 17 个文件添加 console.error 日志
- 新增 REFACTOR_PLAN.md 全景分析文档

src/lib/blindboxPlanGen.ts

@@ -319,7 +319,8 @@ function buildAgentTools(
       try {
         const pois = await searchPois(query, searchType, lat, lng);
         return JSON.stringify(pois);
-      } catch {
+      } catch (e) {
+        console.error("searchPoiTool failed:", e);
         return JSON.stringify([]);
       }
     },
@@ -369,7 +370,8 @@ function buildAgentTools(
         const distanceKm = Math.round(Number(data.route.distance) / 100) / 10;
         const { description, mode } = parseTransitSegments(transit.segments ?? []);
         return JSON.stringify({ durationMin, distanceKm, description, mode });
-      } catch {
+      } catch (e) {
+        console.error("getTravelTimeTool failed:", e);
         return JSON.stringify({ error: "路线查询失败" });
       }
     },
@@ -535,7 +537,8 @@ async function runLegacyPlanGeneration(
       try {
         const pois = await searchPois(idea.searchQuery, idea.searchType, room.lat, room.lng);
         return { query: idea.searchQuery, pois };
-      } catch {
+      } catch (e) {
+        console.error(`searchPois failed for "${idea.searchQuery}":`, e);
         return { query: idea.searchQuery, pois: [] };
       }
     }),
@@ -560,7 +563,8 @@ async function runLegacyPlanGeneration(
         try {
           const pois = await searchPois(idea.searchQuery, idea.searchType, anchorLat, anchorLng);
           return { query: idea.searchQuery, pois };
-        } catch {
+        } catch (e) {
+          console.error(`searchPois (category) failed for "${idea.searchQuery}":`, e);
           return { query: idea.searchQuery, pois: [] };
         }
       }),
@@ -643,7 +647,8 @@ async function queryTransit(
     const transit = data.route.transits[0];
     const { description } = parseTransitSegments(transit.segments ?? []);
     return { durationMin: Math.ceil(Number(transit.duration) / 60), description };
-  } catch {
+  } catch (e) {
+    console.error("queryTransit failed:", e);
     return null;
   }
 }
@@ -770,7 +775,8 @@ export async function runPlanGeneration(
       onProgress,
     );
     days = agentResult.days;
-  } catch {
+  } catch (e) {
+    console.error("runAgentPlanGeneration failed, falling back to legacy:", e);
     onProgress?.("使用备用方案规划...");
     const legacyResult = await runLegacyPlanGeneration(
       { lat: room.lat, lng: room.lng },