fix(favorites): error handling + state hydration + input validation [#87 review]

- addFavorite/removeFavorite now wrap axios in try/catch: a 409 (already favorited,
  common on a stale heart) or 404 resyncs instead of throwing an unhandled promise
  rejection; other errors surface a toast.
- fetchHomeData refreshes favorites BEFORE the TTL cache-return (was appended after
  the early return, so warm-cache loads never refreshed); removed the now-redundant
  trailing call. App.vue onMounted also hydrates favorites so deep-links to Search/
  Playlist show correct hearts.
- favorites API: GET /check rejects non-string (array) query params with 400 instead
  of a 500; POST defaults req.body to {} so a missing JSON body yields the intended 400.

src/web/api/favorites.ts

@@ -15,7 +15,7 @@ export function createFavoritesRouter(database: BotDatabase, logger: Logger): Ro
   // POST /api/favorites — 添加收藏
   router.post("/", (req, res) => {
     const userId = req.user!.id;
-    const { platform, playlistId, name, coverUrl, songCount } = req.body;
+    const { platform, playlistId, name, coverUrl, songCount } = req.body ?? {};
     if (!platform || !playlistId || !name) {
       res.status(400).json({ error: "platform, playlistId, name are required" });
       return;
@@ -64,11 +64,11 @@ export function createFavoritesRouter(database: BotDatabase, logger: Logger): Ro
   router.get("/check", (req, res) => {
     const userId = req.user!.id;
     const { platform, playlistId } = req.query;
-    if (!platform || !playlistId) {
+    if (typeof platform !== "string" || typeof playlistId !== "string") {
       res.status(400).json({ error: "platform and playlistId required" });
       return;
     }
-    const favorited = database.isFavorited(userId, playlistId as string, platform as string);
+    const favorited = database.isFavorited(userId, playlistId, platform);
     res.json({ favorited });
   });