fix: 系统检查修复 — 安全和稳定性

后端：
- config.ts 使用 requireAdmin 中间件，统一响应格式
- feedback.ts 使用 requireAdmin 中间件，移除重复权限检查
- feedback.ts 添加 affectedRows 检查（反馈不存在时返回 404）
- 全局错误处理中间件兜底未捕获异常

前端：
- request.ts 添加 15 秒请求超时设置

server/src/routes/feedback.ts

@@ -1,6 +1,7 @@
 import { Router } from 'express'
 import pool from '../db/connection'
 import { authMiddleware } from '../middleware/auth'
+import { requireAdmin } from '../middleware/requireAdmin'
 
 const router = Router()
 
@@ -30,16 +31,8 @@ router.post('/', authMiddleware, async (req, res) => {
 })
 
 /** 管理员获取反馈列表 */
-router.get('/', authMiddleware, async (req, res) => {
+router.get('/', requireAdmin, async (req, res) => {
   try {
-    const userId = (req as any).userId
-    const [users] = await pool.execute('SELECT role FROM users WHERE id = ?', [userId])
-    const user = (users as any[])[0]
-
-    if (!user || user.role !== 'admin') {
-      return res.status(403).json({ code: 40300, message: '无权限' })
-    }
-
     const page = Math.max(1, parseInt(req.query.page as string) || 1)
     const pageSize = Math.min(100, Math.max(1, parseInt(req.query.pageSize as string) || 20))
     const status = req.query.status as string
@@ -77,16 +70,8 @@ router.get('/', authMiddleware, async (req, res) => {
 })
 
 /** 管理员更新反馈状态 */
-router.put('/:id/status', authMiddleware, async (req, res) => {
+router.put('/:id/status', requireAdmin, async (req, res) => {
   try {
-    const userId = (req as any).userId
-    const [users] = await pool.execute('SELECT role FROM users WHERE id = ?', [userId])
-    const user = (users as any[])[0]
-
-    if (!user || user.role !== 'admin') {
-      return res.status(403).json({ code: 40300, message: '无权限' })
-    }
-
     const { id } = req.params
     const { status, admin_reply } = req.body
 
@@ -102,6 +87,10 @@ router.put('/:id/status', authMiddleware, async (req, res) => {
     )
     const feedback = (feedbackRows as any[])[0]
 
+    if (!feedback) {
+      return res.status(404).json({ code: 40400, message: '反馈不存在' })
+    }
+
     await pool.execute(
       'UPDATE feedbacks SET status = ?, admin_reply = ? WHERE id = ?',
       [status, admin_reply || '', id]