fix: resolve critical audit issues across all modules

Server: add filter/search/pagination to admin list endpoints, enrich
user/device queries with JOINs and subqueries, prevent duplicate active
subscriptions on creation.

Admin console: fix record page TypeError on numeric record_id, correct
mode comparison (integer vs string), fix device detail field names and
command opcode, remove hardcoded login credentials, wire up dead buttons
(unbind, view logs, export), fix user/subscription field mappings.

Miniprogram: fix subscription status string/number mismatches across
index/treatment-setup/profile pages, fix device name field reference,
fix treatment-done null device_id by capturing at onLoad.

miniprogram/pages/treatment-done/treatment-done.js

@@ -22,6 +22,7 @@ Page({
 
   onLoad: function (options) {
     this.setData({ statusBarHeight: app.globalData.statusBarHeight })
+    this._deviceId = options.device_id || (app.globalData.currentDevice && app.globalData.currentDevice.device_id) || ble.getDeviceId() || ''
     var durationMs = parseInt(options.duration) || 0
     var mins = Math.floor(durationMs / 60000)
     var secs = Math.floor((durationMs % 60000) / 1000)
@@ -53,7 +54,7 @@ Page({
 
     http.post('/api/v1/treatment/sync', {
       session_id: self.data.sessionId,
-      device_id: ble.getDeviceId(),
+      device_id: self._deviceId || '',
       start_time: new Date(Date.now() - self.data.duration).toISOString(),
       end_time: new Date().toISOString(),
       regions: self.data.regions,