fix(mapping): correct region↔IO mapping per on-device measurement

Measured on real hardware: IO1=right IO2=left IO3=top IO4=middle IO5=bottom
(0x01=right 0x02=left 0x04=top 0x08=middle 0x10=bottom). The earlier verbal
'left=IO1/upper=IO2...' spec was wrong; this reverts to the original Phase-1
mapping, which the measurement confirms.

- protocol.js REGION constants + getRegionName + REGION_NAMES
- CRITICAL: buildVendorCommand ioMasks was built from REGION.* constants whose
  values just flipped, scrambling IO slot order; pin to literal [0x01..0x10]
- diagnosis.js REGION_DEFS key↔mask; pd_region_map values unchanged (PD is
  keyed by orientation, which is stable) — right=PD5 left=PD1 top=PD2
  middle=PD3,6,7 bottom=PD4
- common.js region labels back to right/left/top/middle/bottom (上/中/下)
- treatment-setup / manual-treatment / treating / scan-report / ble-debug
  face-map bindings and REGION_MAP realigned
- verified: mock pipeline lands left→IO2, middle→IO4 correctly

miniprogram/services/ble/protocol.js

@@ -57,18 +57,18 @@ var TREAT_MODE = {
   SMART: 1
 }
 
-// 区域 = IO 纵列布局（果果 2026-07 定案）：左=IO1(0x01)，中上=IO2(0x02)，中=IO3(0x04)，
-// 中下=IO4(0x08)，右=IO5(0x10)。旧命名(左脸颊/额头/鼻部…)来自过时文档，与实物不符，已废弃。
+// 区域 = IO↔物理位置（果果 2026-07-28 真机实测）：右=IO1(0x01) 左=IO2(0x02) 上=IO3(0x04)
+// 中=IO4(0x08) 下=IO5(0x10)。此前口头给的"纵列左IO1/中上IO2…"实测不符，以本表为准。
 var REGION = {
-  LEFT: 0x01,
-  TOP: 0x02,
-  MIDDLE: 0x04,
-  BOTTOM: 0x08,
-  RIGHT: 0x10,
+  RIGHT: 0x01,
+  LEFT: 0x02,
+  TOP: 0x04,
+  MIDDLE: 0x08,
+  BOTTOM: 0x10,
   FULL_FACE: 0x1F
 }
 
-var REGION_NAMES = ['left', 'top', 'middle', 'bottom', 'right']
+var REGION_NAMES = ['right', 'left', 'top', 'middle', 'bottom']
 
 // FFE4 Byte17 高三位 = 扫描时光色指示（协议简述-添加扫描时光色.docx 2026-07）：
 // 001=红光 010=红外 011=紫外(蓝) 100=暖黄。注意与下发命令的 WAVELENGTH 编码
@@ -196,7 +196,9 @@ function buildVendorCommand(options) {
     b = clampByte(b)
     return isTreat && b > MAX_TREAT_BRIGHTNESS ? MAX_TREAT_BRIGHTNESS : b
   }
-  var ioMasks = [REGION.LEFT, REGION.TOP, REGION.MIDDLE, REGION.BOTTOM, REGION.RIGHT] // IO1..IO5
+  // IO1..IO5 物理槽位 = bit 升序（Byte n*6 对应 mask 1<<n）。直接用字面量，不依赖
+  // REGION 常量名——区域↔mask 语义调整时这里必须始终是 0x01,0x02,0x04,0x08,0x10。
+  var ioMasks = [0x01, 0x02, 0x04, 0x08, 0x10] // IO1=右 IO2=左 IO3=上 IO4=中 IO5=下
   var bytes = []
   var i, j
 
@@ -368,8 +370,8 @@ function parseException(payload) {
 function getRegionName(mask) {
   var names = []
   var bits = [
-    [0x01, '左区'], [0x02, '中上区'], [0x04, '中区'],
-    [0x08, '中下区'], [0x10, '右区']
+    [0x01, '右区'], [0x02, '左区'], [0x04, '上区'],
+    [0x08, '中区'], [0x10, '下区']
   ]
   for (var i = 0; i < bits.length; i++) {
     if (mask & bits[i][0]) names.push(bits[i][1])