fix: 修复后端12个+前端5个高优先级问题

后端:
- devices.js: 修复 newRackId 重复声明、批量移动加事务、ID生成改MAX聚合
- tickets.js: 添加工单状态机校验、req.body白名单过滤
- roles.js: init-roles 添加 authMiddleware
- backup.js: 备份列表只读4KB头部，压缩文件超1MB跳过
- consumables.js: SN查询改用数据库LIKE替代全表扫描
- consumableRecords.js: 出入库加 SELECT FOR UPDATE 行级锁
- inventory.js: not_found 状态判断从 abnormal if 内移到 else if
- idleDevices.js: 删除重复的 batch-restore 路由定义(182行)
- cables.js: 接线冲突检测增加反向端口检查

前端:
- AuthContext.jsx: 初始化时调用 fetchProfile 验证token、Error提取message
- api/index.js: backupAPI.download 返回Promise、checkAdmin改POST
- Login.jsx: checkIsFirstUser 静默处理错误
- DeviceManagement.jsx: 导出 currentPage scope 使用 currentPageDevices

frontend/src/api/index.js

@@ -91,7 +91,7 @@ api.interceptors.response.use(
 );
 
 export const authAPI = {
-  checkAdmin: () => api.get('/auth/check-admin'),
+  checkAdmin: () => api.post('/auth/check-admin'),
   register: data => api.post('/auth/register', data),
   login: data => api.post('/auth/login', data),
   unlock: data => api.post('/auth/unlock', data),
@@ -185,7 +185,7 @@ export const backupAPI = {
   create: (data = {}) => api.post('/backup', data),
   validate: filename => api.get(`/backup/validate/${filename}`),
   restore: (filename, options = {}) => api.post('/backup/restore', { filename, options }),
-  download: filename => `/api/backup/download/${filename}`,
+  download: filename => api.get(`/backup/download/${filename}`, { responseType: 'blob' }),
   delete: filename => api.delete(`/backup/${filename}`),
   upload: file => {
     const formData = new FormData();

frontend/src/context/AuthContext.jsx

@@ -34,7 +34,8 @@ export const AuthProvider = ({ children }) => {
       if (currentUser && JSON.stringify(currentUser) !== JSON.stringify(user)) {
         setUser(currentUser);
       }
-      setInitialized(true);
+      // 有 token 时调用 fetchProfile 验证有效性并刷新用户信息
+      fetchProfile();
     } else if (!currentToken) {
       setToken(null);
       setUser(null);
@@ -49,6 +50,7 @@ export const AuthProvider = ({ children }) => {
     const currentToken = secureStorage.get(TOKEN_KEY);
     if (!currentToken) {
       setLoading(false);
+      setInitialized(true);
       return;
     }
 
@@ -60,8 +62,14 @@ export const AuthProvider = ({ children }) => {
       }
     } catch (error) {
       console.error('获取用户信息失败:', error);
+      // Token 无效，清除登录状态
+      secureStorage.remove(TOKEN_KEY);
+      secureStorage.remove(USER_KEY);
+      setToken(null);
+      setUser(null);
     } finally {
       setLoading(false);
+      setInitialized(true);
     }
   }, []);
 
@@ -78,7 +86,8 @@ export const AuthProvider = ({ children }) => {
       }
       return { success: false, message: response.message, code: response.code };
     } catch (error) {
-      return { success: false, message: error };
+      const message = error?.response?.data?.message || error?.message || '登录失败，请稍后重试';
+      return { success: false, message };
     }
   };
 
@@ -97,7 +106,8 @@ export const AuthProvider = ({ children }) => {
       }
       return { success: false, message: response.message };
     } catch (error) {
-      return { success: false, message: error };
+      const message = error?.response?.data?.message || error?.message || '注册失败，请稍后重试';
+      return { success: false, message };
     }
   };
 

frontend/src/pages/DeviceManagement.jsx

@@ -552,7 +552,7 @@ function DeviceManagement() {
     if (scope === 'selected') {
       deviceIds = selectedDevices;
     } else if (scope === 'currentPage') {
-      deviceIds = allDevices.map(device => device.deviceId);
+      deviceIds = currentPageDevices.map(device => device.deviceId);
     } else if (scope === 'all') {
       deviceIds = allDevices.map(device => device.deviceId);
     }

frontend/src/pages/Login.jsx

@@ -49,7 +49,9 @@ const Login = () => {
         }
       }
     } catch (error) {
-      console.error('检查用户状态失败:', error);
+      // 静默处理：登录页调用 check-admin 失败是正常的（未登录状态）
+      // 不显示错误信息，避免触发 401 重定向循环
+      console.log('检查管理员状态:', error);
     }
   };