fix: audit fixes for registration flow

- loadProfile() now returns Promise (was missing return)
- Avatar upload via COS instead of storing WeChat temp path
- Add POST /user/avatar endpoint with multer + COS SDK
- Incomplete registration detection: redirect to register if phone is empty

miniprogram/app.js

@@ -26,9 +26,10 @@ App({
 
   loadProfile: function () {
     var self = this
-    http.get('/api/v1/user/profile').then(function (profile) {
+    return http.get('/api/v1/user/profile').then(function (profile) {
       self.globalData.userInfo = profile
       self.globalData.userId = String(profile.user_id)
+      return profile
     }).catch(function () {
       wx.removeStorageSync('token')
     })