fix(security): 修复多个严重安全漏洞和运行时崩溃

- devices.js: 修复 hasRoomField 重复 const 声明导致模块加载失败
- devices.js: 修复 batch-status 路由 affectedCount 未定义导致崩溃
- devices.js: 修复 sequelize.literal SQL 注入，转义 LIKE 通配符和字段名
- server.js: 修复 initializeApp() 未 await 导致服务器在初始化前接收请求
- backup.js: 添加 resolveBackupPath() 防止路径遍历攻击（6处）
- inventory.js: 用 bulkCreate 替代原始 SQL 拼接，消除 SQL 注入
- systemSettings.js: 添加全局 authMiddleware，修复敏感操作无认证
- dangerousOperations.js: 添加全局认证，修复日志清理功能完全不可用
- background.js: 添加文件名安全检查、扩展名白名单、路径校验

backend/routes/dangerousOperations.js

@@ -1,5 +1,6 @@
 const express = require('express');
 const router = express.Router();
+const { authMiddleware } = require('../middleware/auth');
 const {
   logDangerousOperation,
   getDangerousOperationsLogs,
@@ -9,6 +10,9 @@ const {
   calculateRiskLevel,
 } = require('../utils/dangerousOperationLogger');
 
+// 全局认证中间件
+router.use(authMiddleware);
+
 router.post('/log', async (req, res) => {
   try {
     const {
@@ -103,7 +107,16 @@ router.delete('/logs/clean', async (req, res) => {
   try {
     const { daysToKeep = 90 } = req.query;
 
-    if (!req.user || req.user.role !== 'admin') {
+    // 通过关联表查询用户角色，判断是否为管理员
+    const UserRole = require('../models/UserRole');
+    const Role = require('../models/Role');
+    const userRole = await UserRole.findOne({
+      where: { UserId: req.user.userId },
+      include: [{ model: Role }],
+    });
+    const isAdmin = userRole && userRole.Role && userRole.Role.roleCode === 'admin';
+
+    if (!isAdmin) {
       return res.status(403).json({ error: '只有管理员才能清理日志' });
     }