fix(mapping): correct region↔IO mapping per on-device measurement

Measured on real hardware: IO1=right IO2=left IO3=top IO4=middle IO5=bottom
(0x01=right 0x02=left 0x04=top 0x08=middle 0x10=bottom). The earlier verbal
'left=IO1/upper=IO2...' spec was wrong; this reverts to the original Phase-1
mapping, which the measurement confirms.

- protocol.js REGION constants + getRegionName + REGION_NAMES
- CRITICAL: buildVendorCommand ioMasks was built from REGION.* constants whose
  values just flipped, scrambling IO slot order; pin to literal [0x01..0x10]
- diagnosis.js REGION_DEFS key↔mask; pd_region_map values unchanged (PD is
  keyed by orientation, which is stable) — right=PD5 left=PD1 top=PD2
  middle=PD3,6,7 bottom=PD4
- common.js region labels back to right/left/top/middle/bottom (上/中/下)
- treatment-setup / manual-treatment / treating / scan-report / ble-debug
  face-map bindings and REGION_MAP realigned
- verified: mock pipeline lands left→IO2, middle→IO4 correctly

miniprogram/pages/treating/treating.js

@@ -23,13 +23,13 @@ Page({
   },
 
   _getRegionText: function (regionMask) {
-    // 掩码 = IO 纵列布局：0x01左 0x02中上 0x04中 0x08中下 0x10右
+    // 掩码 = IO↔物理位置（实测）：0x01右 0x02左 0x04上 0x08中 0x10下
     var REGION_MAP = {
-      1: 'common.regions.left',
-      2: 'common.regions.top',
-      4: 'common.regions.middle',
-      8: 'common.regions.bottom',
-      16: 'common.regions.right'
+      1: 'common.regions.right',
+      2: 'common.regions.left',
+      4: 'common.regions.top',
+      8: 'common.regions.middle',
+      16: 'common.regions.bottom'
     }
     if (regionMask === 0x1F) return i18n.t('treating.allRegions')
     var names = []