refactor: modularize backend security and observability

backend/middleware/error-handler.js

@@ -1,3 +1,5 @@
+const { getRequestId, logger } = require('../utils/logger');
+
 function expressErrorHandler(err, req, res, next) {
   if (res.headersSent) return next(err);
 
@@ -6,14 +8,18 @@ function expressErrorHandler(err, req, res, next) {
     ? requestedStatus
     : 500;
 
-  console.error(`[未处理错误] ${req.method} ${req.originalUrl}`, {
-    message: err?.message,
-    stack: err?.stack
-  });
+  const requestId = getRequestId(req);
+  (req.log || logger).error({
+    err,
+    method: req.method,
+    path: req.path || req.originalUrl,
+    statusCode: status
+  }, 'unhandled request error');
 
   return res.status(status).json({
     success: false,
-    message: status >= 500 ? '服务器内部错误' : (err?.message || '请求处理失败')
+    message: status >= 500 ? '服务器内部错误' : (err?.message || '请求处理失败'),
+    ...(requestId ? { requestId } : {})
   });
 }