refactor: API 请求整合与 Bug 修复

前端重构:
- 新增 api/ 目录统一管理所有 API 请求
- 所有 stores 和 pages 改为使用 api 模块
- 修复日期格式化函数，支持 Date 对象和 ISO 字符串
- 修复 TransactionItem 使用 CategoryIcon 组件
- 优化 ChartWrapper 区分 H5 和小程序环境

后端修复:
- 修复 auth 中间件 PUBLIC_PATHS 缺少 demo-login
- 修复备份工具命令注入漏洞，改用 execFile
- 修复 stats 路由 type 参数验证
- 优化分类排序为批量 SQL 更新
- 合并迁移和删除为数据库事务原子操作
- 修复交易和统计日期返回格式
- 新增自动备份功能（启动时备份）

server/src/routes/stats.ts

@@ -4,6 +4,7 @@ import { AuthRequest } from '../middleware/auth'
 import { getCurrentMonth, getMonthRange } from '../utils/date'
 
 const router = Router()
+const VALID_TYPES = ['expense', 'income']
 
 router.get('/overview', async (req: AuthRequest, res: Response) => {
   try {
@@ -54,6 +55,9 @@ router.get('/overview', async (req: AuthRequest, res: Response) => {
 router.get('/category', async (req: AuthRequest, res: Response) => {
   try {
     const { month, type = 'expense' } = req.query
+    if (!VALID_TYPES.includes(type as string)) {
+      return res.status(400).json({ code: 40002, message: '类型无效' })
+    }
     const m = (month as string) || getCurrentMonth()
     const range = getMonthRange(m)
     if (!range) return res.status(400).json({ code: 40001, message: '月份格式无效' })
@@ -79,13 +83,16 @@ router.get('/category', async (req: AuthRequest, res: Response) => {
 router.get('/trend', async (req: AuthRequest, res: Response) => {
   try {
     const { month, type = 'expense' } = req.query
+    if (!VALID_TYPES.includes(type as string)) {
+      return res.status(400).json({ code: 40002, message: '类型无效' })
+    }
     const m = (month as string) || getCurrentMonth()
     const range = getMonthRange(m)
     if (!range) return res.status(400).json({ code: 40001, message: '月份格式无效' })
     const { startDate, endDate } = range
 
     const [rows] = await pool.query(
-      `SELECT date, SUM(amount) as amount
+      `SELECT DATE_FORMAT(date, '%Y-%m-%d') as date, SUM(amount) as amount
        FROM transactions
        WHERE user_id = ? AND type = ? AND date >= ? AND date <= ?
        GROUP BY date