fix: 全面优化安全、性能和代码质量

P0: 环境变量校验/事务保护/RBAC权限
P1: 花名册分页/密码重置验证码/ErrorBoundary/N+1查询优化
P2: 导出限制/自定义错误类/body大小限制/代码去重
P3: 自定义确认弹窗替换window.confirm

backend/src/routes/import.routes.ts

@@ -2,6 +2,7 @@ import { Router, Response } from 'express'
 import multer from 'multer'
 import * as XLSX from 'xlsx'
 import { authMiddleware, AuthRequest } from '../middleware/auth'
+import { requireAdmin } from '../middleware/rbac'
 import { encrypt, decrypt, sha256 } from '../lib/crypto'
 import prisma from '../lib/prisma'
 
@@ -85,7 +86,7 @@ function num(v: any): number {
 
 // ========== 导入预览（不写入数据库） ==========
 
-router.post('/excel/preview', authMiddleware, upload.single('file'), async (req: AuthRequest, res: Response, next) => {
+router.post('/excel/preview', authMiddleware, requireAdmin, upload.single('file'), async (req: AuthRequest, res: Response, next) => {
   try {
     if (!req.file) return res.status(400).json({ success: false, error: { code: 'BAD_REQUEST', message: '请上传文件' } })
 
@@ -209,7 +210,7 @@ router.post('/excel/error-log', authMiddleware, async (req: AuthRequest, res: Re
   }
 })
 
-router.post('/excel', authMiddleware, upload.single('file'), async (req: AuthRequest, res: Response, next) => {
+router.post('/excel', authMiddleware, requireAdmin, upload.single('file'), async (req: AuthRequest, res: Response, next) => {
   try {
     if (!req.file) return res.status(400).json({ success: false, error: { code: 'BAD_REQUEST', message: '请上传文件' } })
     const orgId = req.user!.orgId
@@ -420,7 +421,7 @@ router.get('/template', authMiddleware, async (_req: AuthRequest, res: Response)
 
 // ========== 月度导入 ==========
 
-router.post('/monthly', authMiddleware, upload.single('file'), async (req: AuthRequest, res: Response, next) => {
+router.post('/monthly', authMiddleware, requireAdmin, upload.single('file'), async (req: AuthRequest, res: Response, next) => {
   try {
     if (!req.file) return res.status(400).json({ success: false, error: { code: 'BAD_REQUEST', message: '请上传文件' } })
     const orgId = req.user!.orgId