refactor: v2 重构 — 模块化拆分 + AI Prompt模板化 + 前端状态管理

P0 - AI交互层:
- ai/prompt.js: 模块化 Prompt 模板
- ai/validator.js: JSON Schema 校验 + normalize
- ai/client.js: DeepSeek API 封装
- 金额计算唯一化，时间格式归一化

P1 - 后端架构:
- routes/: auth/rooms/messages/purchases 独立路由
- middleware/auth.js: 认证授权中间件
- ws/index.js: WebSocket 连接管理
- db.js: 启用 foreign_keys
- server.js: 从588行精简到40行入口

P2 - 前端架构:
- public/css/style.css: CSS 独立
- public/js/store.js: 全局状态 Store
- public/js/{chat,ws,purchases,auth}.js: 功能模块拆分
- index.html: 纯 HTML 结构, v2.6

server/routes/auth.js

@@ -0,0 +1,27 @@
+// 用户认证路由
+const express = require('express');
+const jwt = require('jsonwebtoken');
+const { JWT_SECRET } = require('../middleware/auth');
+const router = express.Router();
+
+const USERS = {};
+(process.env.USERS || '').split(',').forEach(u => {
+  const [name, pass] = u.split(':').map(s => s.trim());
+  if (name && pass) USERS[name] = pass;
+});
+const ADMINS = (process.env.ADMINS || '').split(',').map(s => s.trim()).filter(Boolean);
+
+router.post('/login', (req, res) => {
+  const { username, password } = req.body;
+  if (USERS[username] && USERS[username] === password) {
+    const token = jwt.sign({ username, isAdmin: ADMINS.includes(username) }, JWT_SECRET, { expiresIn: '7d' });
+    return res.json({ token, username, isAdmin: ADMINS.includes(username) });
+  }
+  res.status(401).json({ error: '用户名或密码错误' });
+});
+
+router.get('/user', require('../middleware/auth').authMiddleware, (req, res) => {
+  res.json({ username: req.user.username, isAdmin: req.user.isAdmin });
+});
+
+module.exports = router;