fix: resolve critical audit issues across all modules

Server: add filter/search/pagination to admin list endpoints, enrich
user/device queries with JOINs and subqueries, prevent duplicate active
subscriptions on creation.

Admin console: fix record page TypeError on numeric record_id, correct
mode comparison (integer vs string), fix device detail field names and
command opcode, remove hardcoded login credentials, wire up dead buttons
(unbind, view logs, export), fix user/subscription field mappings.

Miniprogram: fix subscription status string/number mismatches across
index/treatment-setup/profile pages, fix device name field reference,
fix treatment-done null device_id by capturing at onLoad.

miniprogram/pages/index/index.js

@@ -52,7 +52,7 @@ Page({
       if (devices.length > 0) {
         app.globalData.currentDevice = devices[0]
         self.setData({
-          deviceName: devices[0].name || devices[0].device_id || '我的光面膜',
+          deviceName: devices[0].device_name || devices[0].device_id || '我的光面膜',
           deviceInfo: devices[0]
         })
       }
@@ -138,7 +138,7 @@ Page({
   },
 
   onStartTreatment: function () {
-    if (!this.data.subscription || this.data.subscription.status === 0) {
+    if (!this.data.subscription || this.data.subscription.status !== 'active') {
       wx.navigateTo({ url: '/pages/subscribe-prompt/subscribe-prompt' })
       return
     }
@@ -146,7 +146,7 @@ Page({
   },
 
   onViewSubscription: function () {
-    if (!this.data.subscription || this.data.subscription.status === 0) {
+    if (!this.data.subscription || this.data.subscription.status !== 'active') {
       wx.navigateTo({ url: '/pages/subscribe-plans/subscribe-plans' })
     }
   }