feat: add password change, trial subscription, batch import, UX improvements

Server:
- POST /api/v1/admin/password: admin password change with bcrypt migration
- POST /api/v1/subscription/trial: user trial activation, one per user
- POST /api/v1/admin/devices/batch: bulk device import (up to 500)
- Add trial plan (7 days, free) to PLANS constant

Admin console:
- Settings page: add password change form with validation
- Device page: add batch import modal with textarea input

Miniprogram:
- Treating page: add back button with stop-treatment confirmation
- Index page: add mock device bind button (dev mode only)

server/src/routes/admin.js

@@ -31,6 +31,25 @@ function register(router) {
     return ok({ token, admin_id: String(admin.admin_id), username: admin.username, real_name: admin.real_name, role: admin.role })
   })
 
+  router.post('/api/v1/admin/password', async ctx => {
+    const admin = await requireAdmin(ctx)
+    if (!admin) return fail(1002, '未授权，请重新登录')
+    const oldPassword = ctx.body.old_password || ''
+    const newPassword = ctx.body.new_password || ''
+    if (newPassword.length < 6) return fail(2001, 'password too short')
+    const current = await one('SELECT * FROM admin_accounts WHERE admin_id = :admin_id AND status = 1', { admin_id: admin.admin_id })
+    if (!current) return fail(1002, '未授权，请重新登录')
+    let matched = verifyPassword(oldPassword, current.password_hash)
+    if (!matched && current.password_salt && hashPasswordLegacy(oldPassword, current.password_salt) === current.password_hash) {
+      matched = true
+    }
+    if (!matched) return fail(1001, '原密码错误')
+    const newHash = hashPassword(newPassword)
+    await query('UPDATE admin_accounts SET password_hash = :password_hash, password_salt = :password_salt WHERE admin_id = :admin_id', { password_hash: newHash, password_salt: '', admin_id: admin.admin_id })
+    await writeLog({ admin_id: admin.admin_id, action: 'admin_change_password', detail: '管理员修改密码', ip: ctx.ip })
+    return ok({ message: 'success' })
+  })
+
   router.get('/api/v1/admin/dashboard', async ctx => {
     const admin = await requireAdmin(ctx)
     if (!admin) return fail(1002, '未授权，请重新登录')
@@ -71,6 +90,36 @@ function register(router) {
     return ok({ device_id: deviceId })
   })
 
+  router.post('/api/v1/admin/devices/batch', async ctx => {
+    const admin = await requireAdmin(ctx)
+    if (!admin) return fail(1002, '未授权，请重新登录')
+    const deviceIds = ctx.body.device_ids
+    if (!Array.isArray(deviceIds) || deviceIds.length === 0 || deviceIds.length > 500) return fail(2001, 'device_ids must be an array with 1-500 items')
+    let successCount = 0
+    const failedIds = []
+    for (const id of deviceIds) {
+      const deviceId = String(id || '').trim()
+      if (!deviceId) { failedIds.push(id); continue }
+      try {
+        await query(
+          'INSERT INTO devices (device_id, product_id, device_secret, device_name, firmware_version, status) VALUES (:device_id, :product_id, :device_secret, :device_name, :firmware_version, 1) ON DUPLICATE KEY UPDATE product_id = VALUES(product_id), device_secret = VALUES(device_secret), device_name = VALUES(device_name), firmware_version = VALUES(firmware_version), status = 1',
+          {
+            device_id: deviceId,
+            product_id: 'HOX_LIGHT_MASK',
+            device_secret: '',
+            device_name: '光子美容仪',
+            firmware_version: '1.0.0'
+          }
+        )
+        successCount++
+      } catch (err) {
+        failedIds.push(deviceId)
+      }
+    }
+    await writeLog({ admin_id: admin.admin_id, action: 'admin_device_batch_create', detail: '批量预生成产品码: ' + successCount + '/' + deviceIds.length, ip: ctx.ip })
+    return ok({ created: successCount, failed: failedIds })
+  })
+
   router.get('/api/v1/admin/devices/:device_id', async ctx => {
     const admin = await requireAdmin(ctx)
     if (!admin) return fail(1002, '未授权，请重新登录')