refactor(plugins): comprehensive code review - ~35 fixes across 14 plugins

Phase 1 - Plugin code review (14/14 plugins):
- Security: 3x token leak in print→logger.debug, Bearer prefix handling
- Bug: bare except→specific exceptions, HorseState type safety, sync→async
- Critical: response_model undefined, route dead code, sync blocking event loop
- Quality: 11x print()→logger, variable name shadowing, consistent logging

Phase 2 - Deep analysis:
- Fix: payout int truncation→max(1, round(amount*odds))
- Fix: room_store get_lock race condition→dict.setdefault()
- Verify: data_manager f-string SQL is safe (uses ? placeholders)

Infrastructure: review reports generated for all plugins.

danding_bot/plugins/group_horse_racing/test_commands.py

@@ -234,7 +234,7 @@ class _NoopMessageService:
             try:
                 await bot.delete_msg(message_id=msg_id)
             except Exception:
-                pass
+                logger.debug("recall_previous_of_type: failed to delete msg %s", msg_id, exc_info=True)
             del self.last_messages[scope][message_type]
 
 
@@ -254,7 +254,7 @@ async def handle_test_simulate_race(bot: Bot, event: Event):
         race_engine.stop_race(scope)
         await commands_mod.room_store.delete_room(scope)
     except Exception:
-        pass
+        logger.debug("test_simulate_race: cleanup old scope %s failed", scope, exc_info=True)
     original_room_store = commands_mod.room_store
     original_points_service = commands_mod.points_service
     original_message_service = commands_mod.message_service