fix: address critical security and data integrity issues from cross-audit

- Add expire_time > NOW() filter to findActive() preventing stale subscriptions
- Add express-rate-limit on login endpoints (user: 10/15min, admin: 5/15min)
- Add production guard for default admin credentials
- Fix BLE bindDevice userId encoding (uint32 instead of hexToBytes on numeric)
- Wrap adminCreate in transaction to prevent race condition
- Add settings cache invalidation after admin saves
- Read trial_days from settings instead of hardcoding 7
- Fix double JSON.stringify in commandDao.finish call
- Cancel stale pending bindings before creating new ones
- Reduce token refresh grace period from 3 days to 1 day
- Fix subscribe-success to fetch expiry from server (correct for renewals)
- Add keep-alive name property to DashboardView and SettingsView
- Fix BLE disconnect() to preserve listener registrations across reconnects

miniprogram/services/ble/commands.js

@@ -155,7 +155,7 @@ function queryStatus() {
 }
 
 function bindDevice(userId, bindToken) {
-  var userBytes = protocol.hexToBytes(userId)
+  var userBytes = protocol.uint32ToBytes(parseInt(userId, 10))
   var tokenBytes = protocol.hexToBytes(bindToken)
   var ts = Math.floor(Date.now() / 1000)
   var tsBytes = protocol.uint32ToBytes(ts)
@@ -165,7 +165,7 @@ function bindDevice(userId, bindToken) {
 }
 
 function unbindDevice(userId) {
-  var userBytes = protocol.hexToBytes(userId)
+  var userBytes = protocol.uint32ToBytes(parseInt(userId, 10))
   var payload = [0x02].concat(userBytes)
   return writeCommandWithRetry(protocol.CMD.UNBIND, payload)
 }