fix: audit fixes for registration flow

- loadProfile() now returns Promise (was missing return)
- Avatar upload via COS instead of storing WeChat temp path
- Add POST /user/avatar endpoint with multer + COS SDK
- Incomplete registration detection: redirect to register if phone is empty

miniprogram/pages/login/login.js

@@ -16,7 +16,7 @@ Page({
 
     app.doLogin().then(function (data) {
       self.setData({ loading: false })
-      if (data && data.is_new_user) {
+      if (data && (data.is_new_user || !data.user_info || !data.user_info.phone)) {
         wx.redirectTo({ url: '/pages/register/register' })
       } else {
         wx.switchTab({ url: '/pages/index/index' })