refactor: 全面代码重构与项目结构整理

安全性:
- 所有SQL查询改用参数化查询(db_query)，防止SQL注入
- TUSHARE_API_TOKEN集中到config.php常量，移除硬编码和多份拷贝
- getBasic.inc.php中$_REQUEST输出到JS时添加htmlspecialchars转义

代码组织:
- 21个页面文件移至charts/子目录，根目录仅保留入口文件
- ajax.inc.php拆分：esfTradeDaily/esfListDaily迁至getEstate.inc.php
- getBasic.inc.php拆分：HTML组件函数迁至新建的widgets.inc.php
- 前端依赖去重：移除lib/echarts.min.js、libai/3.4.16.js、research/js/3.4.16.js

规范化:
- AJAX响应格式统一为jsonResponse()标准封装
- 前端全局变量统一为window.chartConfig对象模式
- 修复PHP 8.4 Deprecated警告(getEstateData、getStockHistoryDataByTS参数顺序)
- html/head.php中jQuery/CSS路径改为绝对路径，修复charts/子目录加载问题

Co-Authored-By: Claude Code <noreply@anthropic.com>

inc/tradeRec.inc.php

@@ -5,23 +5,19 @@
  * @param $where: add select condition you need.
  * @return array: return stock trade recode history data;
  */
-function trade_rec($ts_code, $day_st, $day_end,$where = ''): array
+function trade_rec($ts_code, $day_st, $day_end, $extra_where = ''): array
 {
     global $mysqli;
     $tmp=explode('.',$ts_code);
     $ts_code = $tmp[0];
     $day_end = ($day_end)?$day_end:date('Y-m-d');
-    $where = $where." and tdate>= '{$day_st}' and tdate<='{$day_end}' and tprice>0"; //担保转出的时候，可能tprice<0
-    if($_REQUEST['t_vendor']=='方正证券') {
-        $sql = <<< EOF
-    select * from trade_record where ts_code = '$ts_code' $where  and length(trade_id)=5 order by tdate asc,ttime asc
-EOF;
-    } elseif($_REQUEST['t_vendor']=='长江证券') {
-    $sql = <<< EOF
-    select * from trade_record_cj where ts_code = '$ts_code' $where   order by tdate asc,ttime asc
-EOF;
-}
-    $result = $mysqli->query($sql) or die($sql);
+    $vendor = $_REQUEST['t_vendor'] ?? '方正证券';
+    if($vendor == '方正证券') {
+        $sql = "select * from trade_record where ts_code = ? and tdate >= ? and tdate <= ? and tprice>0 $extra_where and length(trade_id)=5 order by tdate asc,ttime asc";
+    } elseif($vendor == '长江证券') {
+        $sql = "select * from trade_record_cj where ts_code = ? and tdate >= ? and tdate <= ? and tprice>0 $extra_where order by tdate asc,ttime asc";
+    }
+    $result = db_query($mysqli, $sql, [$ts_code, $day_st, $day_end]);
     return $result->fetch_all(MYSQLI_ASSOC);
 }
 
@@ -134,10 +130,10 @@ function tradeSummary($dataBuy,$dataSell,$dataAll):array{
 
 function recentPrice($ts_code){
     global $mysqli;
-    $sql = "SELECT close FROM `stock_his_pro` where ts_code='".ts_code_conv($ts_code)."' and trade_date=(select max(trade_date) from stock_his_pro)";
-    $result = $mysqli->query($sql) or die($sql);
-    $rt = $result->fetch_all(MYSQLI_ASSOC); //MYSQLI_ASSOC object $rt[0]['close']
-    return $rt[0];   //get arr['close']
+    $sql = "SELECT close FROM stock_his_pro where ts_code = ? and trade_date=(select max(trade_date) from stock_his_pro)";
+    $result = db_query($mysqli, $sql, [ts_code_conv($ts_code)]);
+    $rt = $result->fetch_all(MYSQLI_ASSOC);
+    return $rt[0];
 }
 
 /**