fix: resolve critical audit issues across all modules

Server: add filter/search/pagination to admin list endpoints, enrich
user/device queries with JOINs and subqueries, prevent duplicate active
subscriptions on creation.

Admin console: fix record page TypeError on numeric record_id, correct
mode comparison (integer vs string), fix device detail field names and
command opcode, remove hardcoded login credentials, wire up dead buttons
(unbind, view logs, export), fix user/subscription field mappings.

Miniprogram: fix subscription status string/number mismatches across
index/treatment-setup/profile pages, fix device name field reference,
fix treatment-done null device_id by capturing at onLoad.

miniprogram/pages/treatment-setup/treatment-setup.js

@@ -39,7 +39,7 @@ Page({
     var self = this
     http.get('/api/v1/subscription').then(function (sub) {
       self.setData({
-        subExpired: sub.status !== 1,
+        subExpired: sub.status !== 'active',
         subDays: sub.remaining_days || 0
       })
     }).catch(function () {})