fix(security): 修复多个严重安全漏洞和运行时崩溃

- devices.js: 修复 hasRoomField 重复 const 声明导致模块加载失败
- devices.js: 修复 batch-status 路由 affectedCount 未定义导致崩溃
- devices.js: 修复 sequelize.literal SQL 注入，转义 LIKE 通配符和字段名
- server.js: 修复 initializeApp() 未 await 导致服务器在初始化前接收请求
- backup.js: 添加 resolveBackupPath() 防止路径遍历攻击（6处）
- inventory.js: 用 bulkCreate 替代原始 SQL 拼接，消除 SQL 注入
- systemSettings.js: 添加全局 authMiddleware，修复敏感操作无认证
- dangerousOperations.js: 添加全局认证，修复日志清理功能完全不可用
- background.js: 添加文件名安全检查、扩展名白名单、路径校验

backend/routes/inventory.js

@@ -250,23 +250,8 @@ router.post('/plans/:planId/start', async (req, res) => {
     }
 
     if (recordsToCreate.length > 0) {
-      const now =
-        dbDialect === 'mysql'
-          ? new Date().toISOString().replace('T', ' ').replace('Z', '')
-          : new Date().toISOString();
-      const placeholders = recordsToCreate
-        .map(
-          r =>
-            `('${r.recordId}', '${r.taskId}', '${r.planId}', '${r.deviceId}', '${r.deviceName}', '${r.deviceType}', '${r.serialNumber || ''}', '${r.rackId}', ${r.position}, 'pending', '${now}', '${now}')`
-        )
-        .join(',');
-
-      if (placeholders) {
-        await sequelize.query(`
-          INSERT INTO inventory_records (recordId, taskId, planId, deviceId, deviceName, deviceType, serialNumber, rackId, position, status, createdAt, updatedAt)
-          VALUES ${placeholders}
-        `);
-      }
+      // 使用 Sequelize bulkCreate 替代原始 SQL，自动参数化防止 SQL 注入
+      await InventoryRecord.bulkCreate(recordsToCreate, { individualHooks: false });
     }
 
     await plan.update({