fix: use MySQL DATE_ADD instead of JS dates for bind token expiry

SCF runs in UTC but MySQL connection uses timezone +08:00, causing
bind_expires computed in JS to mismatch NOW() in SQL queries.
Use DATE_ADD(NOW(), INTERVAL ...) directly in SQL to guarantee
consistent timezone for both storage and comparison.

server/src/routes/device.js

@@ -2,13 +2,12 @@ const { one, query, transaction } = require('../lib/db')
 const { ok, fail } = require('../lib/response')
 const { requireUser, randomHex } = require('../lib/auth')
 const { writeLog } = require('../lib/log')
-const { formatDate } = require('../lib/utils')
+
 
 async function ensureTrial(conn, userId) {
   const [subs] = await conn.execute('SELECT subscription_id FROM subscriptions WHERE user_id = ? AND status = 1 AND expire_time > NOW() LIMIT 1', [userId])
   if (subs.length > 0) return
-  const expire = formatDate(new Date(Date.now() + 7 * 24 * 3600 * 1000))
-  await conn.execute('INSERT INTO subscriptions (user_id, plan, status, amount, start_time, expire_time) VALUES (?, ?, 1, 0, NOW(), ?)', [userId, 'trial', expire])
+  await conn.execute('INSERT INTO subscriptions (user_id, plan, status, amount, start_time, expire_time) VALUES (?, ?, 1, 0, NOW(), DATE_ADD(NOW(), INTERVAL 7 DAY))', [userId, 'trial'])
 }
 
 function register(router) {
@@ -26,12 +25,11 @@ function register(router) {
       if (devices.length === 0) return { invalid: true }
 
       const bindToken = randomHex(8)
-      const bindExpires = formatDate(new Date(Date.now() + 10 * 60 * 1000))
       await conn.execute(
-        'INSERT INTO bindings (user_id, device_id, bind_token, bind_expires, bind_status, bind_time) VALUES (?, ?, ?, ?, 3, NOW())',
-        [user.user_id, deviceId, bindToken, bindExpires]
+        'INSERT INTO bindings (user_id, device_id, bind_token, bind_expires, bind_status, bind_time) VALUES (?, ?, ?, DATE_ADD(NOW(), INTERVAL 10 MINUTE), 3, NOW())',
+        [user.user_id, deviceId, bindToken]
       )
-      return { device_id: deviceId, bind_token: bindToken, bind_expires: bindExpires }
+      return { device_id: deviceId, bind_token: bindToken }
     })
 
     if (result.invalid) return fail(1005, 'DEVICE_NOT_FOUND')