fix: address critical security and data integrity issues from cross-audit

- Add expire_time > NOW() filter to findActive() preventing stale subscriptions
- Add express-rate-limit on login endpoints (user: 10/15min, admin: 5/15min)
- Add production guard for default admin credentials
- Fix BLE bindDevice userId encoding (uint32 instead of hexToBytes on numeric)
- Wrap adminCreate in transaction to prevent race condition
- Add settings cache invalidation after admin saves
- Read trial_days from settings instead of hardcoding 7
- Fix double JSON.stringify in commandDao.finish call
- Cancel stale pending bindings before creating new ones
- Reduce token refresh grace period from 3 days to 1 day
- Fix subscribe-success to fetch expiry from server (correct for renewals)
- Add keep-alive name property to DashboardView and SettingsView
- Fix BLE disconnect() to preserve listener registrations across reconnects

server/src/routes/subscription.js

@@ -2,6 +2,7 @@ const router = require('express').Router()
 const { ok, fail } = require('../lib/response')
 const { requireUser } = require('../middleware/auth')
 const { requireAdmin } = require('../middleware/auth')
+const { getSettings } = require('../lib/settings-cache')
 const subscriptionDao = require('../dao/subscription.dao')
 const logDao = require('../dao/log.dao')
 
@@ -64,8 +65,10 @@ router.post('/subscription/trial', requireUser, wrap(async (req, res) => {
   if (usedTrial) return res.json(fail(2001, '已使用过试用'))
   const activeSub = await subscriptionDao.findActive(req.user.user_id)
   if (activeSub) return res.json(fail(2001, '已有有效订阅'))
-  await subscriptionDao.createTrial(req.user.user_id)
-  res.json(ok({ status: 'active', plan: 'trial', remaining_days: 7 }))
+  const settings = await getSettings()
+  const trialDays = Number(settings.trial_days) || 7
+  await subscriptionDao.createTrial(req.user.user_id, undefined, trialDays)
+  res.json(ok({ status: 'active', plan: 'trial', remaining_days: trialDays }))
 }))
 
 // Temporary: admin-only until payment integration