feat(iter-v2): T01 complete - security + infrastructure

- S1: .githooks/pre-commit blocks .env commits, .env.test in .gitignore
- S3: TOKEN_SECRET centralized to config/token.ts, all files import from it
- S3: checkTokenSecret enforces min 32-char TOKEN_SECRET at startup
- S5: Refresh Token mechanism (Access 2h + Refresh 30d, dual token)
- S5: POST /auth/refresh endpoint with rotation and max 5 per user
- S5: Frontend request.ts auto-refresh on 40101, concurrent-safe
- S6: Soft delete (deleted_at column), admin soft-delete with confirmName
- S6: POST /admin/users/:id/restore endpoint
- S6: All user queries filter deleted_at IS NULL
- S7: DB connection requires env vars, no fallback credentials
- Infra: jest.config.js, vitest.config.ts, .env.test
- Infra: node-cron, jest, ts-jest, supertest, vitest, @pinia/testing

server/src/routes/user.ts

@@ -48,7 +48,7 @@ const upload = multer({
 router.get('/me', async (req: AuthRequest, res: Response) => {
   try {
     const [rows] = await pool.query(
-      'SELECT id, nickname, avatar_url, slogan, role, created_at FROM users WHERE id = ?',
+      'SELECT id, nickname, avatar_url, slogan, role, created_at FROM users WHERE id = ? AND deleted_at IS NULL',
       [req.userId]
     )
     const user = (rows as any[])[0]
@@ -123,7 +123,7 @@ router.post('/avatar', (req: AuthRequest, res: Response) => {
     }
     try {
       // 先查询旧头像
-      const [rows] = await pool.query('SELECT avatar_url FROM users WHERE id = ?', [req.userId])
+      const [rows] = await pool.query('SELECT avatar_url FROM users WHERE id = ? AND deleted_at IS NULL', [req.userId])
       const oldUrl = (rows as any[])[0]?.avatar_url
 
       // 先更新 DB，再删旧文件（保证 DB 和文件至少有一个正确）