fix: resolve critical audit issues across all modules

Server: add filter/search/pagination to admin list endpoints, enrich
user/device queries with JOINs and subqueries, prevent duplicate active
subscriptions on creation.

Admin console: fix record page TypeError on numeric record_id, correct
mode comparison (integer vs string), fix device detail field names and
command opcode, remove hardcoded login credentials, wire up dead buttons
(unbind, view logs, export), fix user/subscription field mappings.

Miniprogram: fix subscription status string/number mismatches across
index/treatment-setup/profile pages, fix device name field reference,
fix treatment-done null device_id by capturing at onLoad.

miniprogram/pages/treating/treating.js

@@ -23,6 +23,7 @@ Page({
   onLoad: function (options) {
     var app = getApp()
     this.setData({ statusBarHeight: app.globalData.statusBarHeight, devMode: config.__DEV__ || false })
+    this._deviceId = ble.getDeviceId() || (app.globalData.currentDevice && app.globalData.currentDevice.device_id) || ''
     this.setData({
       regions: parseInt(options.regions) || 0x7F,
       wavelength: parseInt(options.wavelength) || 2,
@@ -115,7 +116,8 @@ Page({
           '&regions=' + result.regions +
           '&duration=' + result.total_duration_ms +
           '&avg_pd=' + result.avg_pd +
-          '&mode=' + (self.data.mode || 0)
+          '&mode=' + (self.data.mode || 0) +
+          '&device_id=' + encodeURIComponent(self._deviceId || '')
       })
     }, 1000)
   },