fix: 全面优化安全、性能和代码质量

P0: 环境变量校验/事务保护/RBAC权限
P1: 花名册分页/密码重置验证码/ErrorBoundary/N+1查询优化
P2: 导出限制/自定义错误类/body大小限制/代码去重
P3: 自定义确认弹窗替换window.confirm

backend/src/routes/auth.routes.ts

@@ -81,6 +81,11 @@ router.post('/forgot-password/verify', authLimiter, async (req, res, next) => {
 router.post('/reset-password', authLimiter, async (req, res, next) => {
   try {
     const data = resetPasswordSchema.parse(req.body)
+    const stored = codeStore.get(data.phone)
+    if (!stored || stored.expiresAt < Date.now()) {
+      return res.status(400).json({ success: false, error: { code: 'CODE_EXPIRED', message: '验证码已过期，请重新获取' } })
+    }
+    codeStore.delete(data.phone)
     const result = await resetPassword(data.phone, data.newPassword)
     res.json({ success: true, data: result })
   } catch (err) {