fix(security): 修复多个严重安全漏洞和运行时崩溃

- devices.js: 修复 hasRoomField 重复 const 声明导致模块加载失败
- devices.js: 修复 batch-status 路由 affectedCount 未定义导致崩溃
- devices.js: 修复 sequelize.literal SQL 注入，转义 LIKE 通配符和字段名
- server.js: 修复 initializeApp() 未 await 导致服务器在初始化前接收请求
- backup.js: 添加 resolveBackupPath() 防止路径遍历攻击（6处）
- inventory.js: 用 bulkCreate 替代原始 SQL 拼接，消除 SQL 注入
- systemSettings.js: 添加全局 authMiddleware，修复敏感操作无认证
- dangerousOperations.js: 添加全局认证，修复日志清理功能完全不可用
- background.js: 添加文件名安全检查、扩展名白名单、路径校验

backend/server.js

@@ -226,7 +226,14 @@ const { specs, customCSS } = require('./swagger');
 const { authMiddleware } = require('./middleware/auth');
 const loadRoutes = require('./utils/routeLoader');
 
-initializeApp();
+initializeApp().then(() => {
+  app.listen(PORT, () => {
+    console.log(`服务器运行在 http://localhost:${PORT}`);
+  });
+}).catch(err => {
+  console.error('应用初始化失败:', err);
+  process.exit(1);
+});
 
 const PUBLIC_PATHS = [
   '/auth',
@@ -234,6 +241,7 @@ const PUBLIC_PATHS = [
   '/docs',
   '/api-docs',
   '/api-docs.json',
+  '/system-settings/system/info',
 ];
 
 const isPublicPath = (path) => {
@@ -318,6 +326,4 @@ app.get('/health', async (req, res) => {
   res.status(statusCode).json(health);
 });
 
-app.listen(PORT, () => {
-  console.log(`服务器运行在 http://localhost:${PORT}`);
-});
+// app.listen 已在 initializeApp().then() 中调用