fix: E2E 测试发现的后端 BUG 修复 — 限流拆分 + 积分查询 + 错误码修正

- 拆分 refresh token 限流为独立中间件（30次/分 vs 登录5次/分）
- 修复积分 recent-activity 500：JOIN 通过 points_account 中间表
- 修复患者/医生不存在返回 400 → 正确的 404 NotFound

crates/erp-health/src/error.rs

@@ -128,7 +128,7 @@ impl From<HealthError> for AppError {
         match err {
             HealthError::Validation(s) => AppError::Validation(s),
             HealthError::PatientNotFound | HealthError::DoctorNotFound => {
-                AppError::Validation(err.to_string())
+                AppError::NotFound(err.to_string())
             }
             HealthError::AppointmentNotFound
             | HealthError::ScheduleNotFound

crates/erp-health/src/service/stats_service/dashboard.rs

@@ -74,7 +74,8 @@ pub async fn get_points_recent_activity(
                CASE WHEN pt.amount >= 0 THEN 'earn' ELSE 'spend' END AS type,
                pt.created_at::text
         FROM points_transaction pt
-        LEFT JOIN patient p ON p.id = pt.patient_id AND p.deleted_at IS NULL
+        LEFT JOIN points_account pa ON pa.id = pt.account_id AND pa.deleted_at IS NULL
+        LEFT JOIN patient p ON p.id = pa.patient_id AND p.deleted_at IS NULL
         WHERE pt.tenant_id = $1 AND pt.deleted_at IS NULL
         ORDER BY pt.created_at DESC
         LIMIT $2