fix: 全面优化安全、性能和代码质量

P0: 环境变量校验/事务保护/RBAC权限
P1: 花名册分页/密码重置验证码/ErrorBoundary/N+1查询优化
P2: 导出限制/自定义错误类/body大小限制/代码去重
P3: 自定义确认弹窗替换window.confirm

backend/src/lib/AppError.ts

@@ -0,0 +1,18 @@
+export class AppError extends Error {
+  constructor(
+    public code: string,
+    message: string,
+    public statusCode: number = 400,
+  ) {
+    super(message)
+    this.name = 'AppError'
+  }
+}
+
+export function isAppError(err: unknown): err is AppError {
+  return err instanceof AppError
+}
+
+export function throwAppError(code: string, message: string, statusCode: number = 400): never {
+  throw new AppError(code, message, statusCode)
+}

backend/src/lib/config.ts

@@ -0,0 +1,22 @@
+const required = ['JWT_SECRET', 'JWT_REFRESH_SECRET', 'ENCRYPTION_KEY']
+const defaults: Record<string, string> = {
+  JWT_SECRET: 'dev-secret',
+  JWT_REFRESH_SECRET: 'dev-refresh-secret',
+  ENCRYPTION_KEY: 'default-32-byte-encryption-key!!',
+}
+
+export function validateEnv(): void {
+  const missing: string[] = []
+  for (const key of required) {
+    if (!process.env[key] || process.env[key] === defaults[key]) {
+      missing.push(key)
+    }
+  }
+  if (missing.length > 0 && process.env.NODE_ENV === 'production') {
+    console.error(`[FATAL] 以下环境变量未设置或使用了默认值，生产环境禁止启动: ${missing.join(', ')}`)
+    process.exit(1)
+  }
+  if (missing.length > 0) {
+    console.warn(`[WARN] 以下环境变量使用了默认值，仅限开发环境: ${missing.join(', ')}`)
+  }
+}