fix: resolve critical audit issues across all modules

Server: add filter/search/pagination to admin list endpoints, enrich
user/device queries with JOINs and subqueries, prevent duplicate active
subscriptions on creation.

Admin console: fix record page TypeError on numeric record_id, correct
mode comparison (integer vs string), fix device detail field names and
command opcode, remove hardcoded login credentials, wire up dead buttons
(unbind, view logs, export), fix user/subscription field mappings.

Miniprogram: fix subscription status string/number mismatches across
index/treatment-setup/profile pages, fix device name field reference,
fix treatment-done null device_id by capturing at onLoad.

miniprogram/pages/index/index.js

@@ -52,7 +52,7 @@ Page({
       if (devices.length > 0) {
         app.globalData.currentDevice = devices[0]
         self.setData({
-          deviceName: devices[0].name || devices[0].device_id || '我的光面膜',
+          deviceName: devices[0].device_name || devices[0].device_id || '我的光面膜',
           deviceInfo: devices[0]
         })
       }
@@ -138,7 +138,7 @@ Page({
   },
 
   onStartTreatment: function () {
-    if (!this.data.subscription || this.data.subscription.status === 0) {
+    if (!this.data.subscription || this.data.subscription.status !== 'active') {
       wx.navigateTo({ url: '/pages/subscribe-prompt/subscribe-prompt' })
       return
     }
@@ -146,7 +146,7 @@ Page({
   },
 
   onViewSubscription: function () {
-    if (!this.data.subscription || this.data.subscription.status === 0) {
+    if (!this.data.subscription || this.data.subscription.status !== 'active') {
       wx.navigateTo({ url: '/pages/subscribe-plans/subscribe-plans' })
     }
   }

miniprogram/pages/profile/profile.js

@@ -35,13 +35,13 @@ Page({
   },
 
   onViewSubscription: function () {
-    if (!this.data.subscription || this.data.subscription.status === 0) {
+    if (!this.data.subscription || this.data.subscription.status !== 'active') {
       wx.navigateTo({ url: '/pages/subscribe-plans/subscribe-plans' })
     } else {
       var sub = this.data.subscription
       wx.showModal({
         title: '订阅信息',
-        content: '套餐类型：' + (sub.plan_type || '未知') + '\n剩余天数：' + (sub.remaining_days || 0) + '天',
+        content: '套餐类型：' + (sub.plan || '未知') + '\n剩余天数：' + (sub.remaining_days || 0) + '天',
         showCancel: false
       })
     }

miniprogram/pages/treating/treating.js

@@ -23,6 +23,7 @@ Page({
   onLoad: function (options) {
     var app = getApp()
     this.setData({ statusBarHeight: app.globalData.statusBarHeight, devMode: config.__DEV__ || false })
+    this._deviceId = ble.getDeviceId() || (app.globalData.currentDevice && app.globalData.currentDevice.device_id) || ''
     this.setData({
       regions: parseInt(options.regions) || 0x7F,
       wavelength: parseInt(options.wavelength) || 2,
@@ -115,7 +116,8 @@ Page({
           '&regions=' + result.regions +
           '&duration=' + result.total_duration_ms +
           '&avg_pd=' + result.avg_pd +
-          '&mode=' + (self.data.mode || 0)
+          '&mode=' + (self.data.mode || 0) +
+          '&device_id=' + encodeURIComponent(self._deviceId || '')
       })
     }, 1000)
   },

miniprogram/pages/treatment-done/treatment-done.js

@@ -22,6 +22,7 @@ Page({
 
   onLoad: function (options) {
     this.setData({ statusBarHeight: app.globalData.statusBarHeight })
+    this._deviceId = options.device_id || (app.globalData.currentDevice && app.globalData.currentDevice.device_id) || ble.getDeviceId() || ''
     var durationMs = parseInt(options.duration) || 0
     var mins = Math.floor(durationMs / 60000)
     var secs = Math.floor((durationMs % 60000) / 1000)
@@ -53,7 +54,7 @@ Page({
 
     http.post('/api/v1/treatment/sync', {
       session_id: self.data.sessionId,
-      device_id: ble.getDeviceId(),
+      device_id: self._deviceId || '',
       start_time: new Date(Date.now() - self.data.duration).toISOString(),
       end_time: new Date().toISOString(),
       regions: self.data.regions,

miniprogram/pages/treatment-setup/treatment-setup.js

@@ -39,7 +39,7 @@ Page({
     var self = this
     http.get('/api/v1/subscription').then(function (sub) {
       self.setData({
-        subExpired: sub.status !== 1,
+        subExpired: sub.status !== 'active',
         subDays: sub.remaining_days || 0
       })
     }).catch(function () {})