fix: 修复后端12个+前端5个高优先级问题

后端:
- devices.js: 修复 newRackId 重复声明、批量移动加事务、ID生成改MAX聚合
- tickets.js: 添加工单状态机校验、req.body白名单过滤
- roles.js: init-roles 添加 authMiddleware
- backup.js: 备份列表只读4KB头部，压缩文件超1MB跳过
- consumables.js: SN查询改用数据库LIKE替代全表扫描
- consumableRecords.js: 出入库加 SELECT FOR UPDATE 行级锁
- inventory.js: not_found 状态判断从 abnormal if 内移到 else if
- idleDevices.js: 删除重复的 batch-restore 路由定义(182行)
- cables.js: 接线冲突检测增加反向端口检查

前端:
- AuthContext.jsx: 初始化时调用 fetchProfile 验证token、Error提取message
- api/index.js: backupAPI.download 返回Promise、checkAdmin改POST
- Login.jsx: checkIsFirstUser 静默处理错误
- DeviceManagement.jsx: 导出 currentPage scope 使用 currentPageDevices

backend/routes/consumableRecords.js

@@ -56,7 +56,18 @@ router.post('/', async (req, res) => {
   try {
     const { consumableId, type, quantity, operator, reason, recipient, notes } = req.body;
 
-    const consumable = await Consumable.findByPk(consumableId);
+    // 确保 quantity 为数值
+    const numQuantity = parseFloat(quantity);
+    if (isNaN(numQuantity) || numQuantity <= 0) {
+      await transaction.rollback();
+      return res.status(400).json({ error: '数量必须为正数' });
+    }
+
+    // 使用 SELECT ... FOR UPDATE 行级锁，防止并发修改
+    const consumable = await Consumable.findByPk(consumableId, {
+      transaction,
+      lock: transaction.LOCK.UPDATE,
+    });
     if (!consumable) {
       await transaction.rollback();
       return res.status(404).json({ error: '耗材不存在' });
@@ -66,13 +77,13 @@ router.post('/', async (req, res) => {
     let newStock;
 
     if (type === 'in') {
-      newStock = previousStock + quantity;
+      newStock = previousStock + numQuantity;
     } else if (type === 'out') {
-      if (previousStock < quantity) {
+      if (previousStock < numQuantity) {
         await transaction.rollback();
         return res.status(400).json({ error: '库存不足' });
       }
-      newStock = previousStock - quantity;
+      newStock = previousStock - numQuantity;
     } else {
       await transaction.rollback();
       return res.status(400).json({ error: '操作类型无效' });
@@ -84,7 +95,7 @@ router.post('/', async (req, res) => {
       {
         consumableId,
         type,
-        quantity,
+        quantity: numQuantity,
         previousStock,
         currentStock: newStock,
         operator,
@@ -100,7 +111,7 @@ router.post('/', async (req, res) => {
         consumableId,
         consumableName: consumable.name,
         operationType: type,
-        quantity: type === 'in' ? parseFloat(quantity) : -parseFloat(quantity),
+        quantity: type === 'in' ? numQuantity : -numQuantity,
         previousStock,
         currentStock: newStock,
         operator,