使用 Tactic Remote 自動化程式碼審查

# Code Review Instructions
 
Review all changes on the current branch compared to the `main` branch.
 
## What to Check
 
### Critical Issues (must fix before merge)
 
- **Logic errors**: Code that doesn't do what it claims
- **Security vulnerabilities**: SQL injection, XSS, auth bypasses, credential exposure
- **Data loss risks**: Missing transactions, incorrect cascade deletes, race conditions
- **Breaking changes**: API contract violations, backwards-incompatible modifications
 
### Warnings (should fix, but not blocking)
 
- **Missing error handling**: Uncaught exceptions, unhandled promise rejections
- **Performance concerns**: N+1 queries, unnecessary re-renders, missing memoization
- **Missing validation**: User input not validated before processing
- **Test coverage gaps**: New code paths without corresponding tests
 
### Suggestions (nice to have)
 
- **Readability improvements**: Unclear variable names, complex logic that could be simplified
- **Documentation gaps**: Public APIs without JSDoc/TSDoc comments
- **Potential refactoring**: Duplicated logic, overly long functions
 
## Output Format
 
For each finding, provide:
 
1. **Severity**: CRITICAL / WARNING / SUGGESTION
2. **File**: Exact file path and line numbers
3. **Description**: What the issue is, in one sentence
4. **Explanation**: Why it matters, with context
5. **Fix**: Concrete code suggestion to resolve the issue
 
At the end, provide:
 
- Summary: X critical, Y warnings, Z suggestions
- Overall assessment: Is this branch ready for human review?
 
## What NOT to Flag
 
- Style preferences covered by our linter (ESLint/Prettier handle this)
- Import ordering (automated)
- Whitespace or formatting (automated)
- Type annotations that TypeScript can infer

Checkout branch feature/user-dashboard.
Follow the review instructions in .claude-review-prompt.md.

🔴 CRITICAL — src/api/routes/users.ts:47-52

Description: SQL query constructed with string concatenation, vulnerable to injection.

Explanation: The search query parameter is interpolated directly into the SQL
string without parameterization. An attacker could craft a search input that
modifies the query logic, potentially extracting or modifying data.

Fix: Use parameterized query:
  // Before (vulnerable)
  const results = db.query(`SELECT * FROM users WHERE name LIKE '%${search}%'`)

  // After (safe)
  const results = db.query('SELECT * FROM users WHERE name LIKE ?', [`%${search}%`])

Apply the fix for the SQL injection issue in users.ts:47.

Explain the SQL injection risk in more detail. Is this exploitable given
our authentication middleware that runs before this route?

Apply fixes for all CRITICAL and WARNING findings from the review.
For each fix, run the relevant tests to verify the fix doesn't break anything.
Report which fixes were applied and which tests passed.

Show me the complete git diff of all changes made during this review.

Create a pull request description that includes:
1. What this branch does (based on the commit history)
2. Summary of the AI review findings and how they were addressed
3. Any remaining suggestions that were intentionally deferred
4. Test results

Review all commits since the last review marker.
After completing the review, create a git tag 'last-ai-review' at HEAD.