fix(security): 修复多个严重安全漏洞和运行时崩溃

- devices.js: 修复 hasRoomField 重复 const 声明导致模块加载失败
- devices.js: 修复 batch-status 路由 affectedCount 未定义导致崩溃
- devices.js: 修复 sequelize.literal SQL 注入，转义 LIKE 通配符和字段名
- server.js: 修复 initializeApp() 未 await 导致服务器在初始化前接收请求
- backup.js: 添加 resolveBackupPath() 防止路径遍历攻击（6处）
- inventory.js: 用 bulkCreate 替代原始 SQL 拼接，消除 SQL 注入
- systemSettings.js: 添加全局 authMiddleware，修复敏感操作无认证
- dangerousOperations.js: 添加全局认证，修复日志清理功能完全不可用
- background.js: 添加文件名安全检查、扩展名白名单、路径校验

backend/routes/systemSettings.js

@@ -3,6 +3,19 @@ const router = express.Router();
 const fs = require('fs');
 const path = require('path');
 const { Op } = require('sequelize');
+const { authMiddleware } = require('../middleware/auth');
+
+// 公开路由（无需认证）- 使用 originalUrl 匹配，兼容子路由挂载
+const publicRoutes = ['/system/info'];
+
+// 全局认证中间件：所有路由默认需要认证
+router.use((req, res, next) => {
+  const fullPath = req.originalUrl || req.path;
+  if (publicRoutes.some(p => fullPath.endsWith(p))) {
+    return next();
+  }
+  return authMiddleware(req, res, next);
+});
 const SystemSetting = require('../models/SystemSetting');
 const { FRONTEND } = require('../config');