fix(mapping): correct region↔IO mapping per on-device measurement

Measured on real hardware: IO1=right IO2=left IO3=top IO4=middle IO5=bottom
(0x01=right 0x02=left 0x04=top 0x08=middle 0x10=bottom). The earlier verbal
'left=IO1/upper=IO2...' spec was wrong; this reverts to the original Phase-1
mapping, which the measurement confirms.

- protocol.js REGION constants + getRegionName + REGION_NAMES
- CRITICAL: buildVendorCommand ioMasks was built from REGION.* constants whose
  values just flipped, scrambling IO slot order; pin to literal [0x01..0x10]
- diagnosis.js REGION_DEFS key↔mask; pd_region_map values unchanged (PD is
  keyed by orientation, which is stable) — right=PD5 left=PD1 top=PD2
  middle=PD3,6,7 bottom=PD4
- common.js region labels back to right/left/top/middle/bottom (上/中/下)
- treatment-setup / manual-treatment / treating / scan-report / ble-debug
  face-map bindings and REGION_MAP realigned
- verified: mock pipeline lands left→IO2, middle→IO4 correctly

miniprogram/pages/manual-treatment/manual-treatment.js

@@ -22,13 +22,13 @@ Page({
     ],
     selectedFunctionId: 'rejuvenate',
     selectedWavelength: 2,
-    // 掩码 = IO 纵列布局（与 treatment-setup 一致）：左=0x01 中上=0x02 中=0x04 中下=0x08 右=0x10
+    // 掩码 = IO↔物理位置（实测）：右=0x01 左=0x02 上=0x04 中=0x08 下=0x10
     regions: [
-      { key: 'left', mask: 0x01, checked: true },
-      { key: 'top', mask: 0x02, checked: true },
-      { key: 'middle', mask: 0x04, checked: true },
-      { key: 'bottom', mask: 0x08, checked: true },
-      { key: 'right', mask: 0x10, checked: true }
+      { key: 'right', mask: 0x01, checked: true },
+      { key: 'left', mask: 0x02, checked: true },
+      { key: 'top', mask: 0x04, checked: true },
+      { key: 'middle', mask: 0x08, checked: true },
+      { key: 'bottom', mask: 0x10, checked: true }
     ],
     // safety: a single session must NOT exceed 10 minutes (hardware caps at 10).
     durations: [5, 10],