fix: resolve final audit issues

- firmware route: extract insertId from ResultSetHeader correctly
- admin device detail: add null check and flatten response to match
  frontend's expected field structure
- device command result: add ownership verification before finishing
  command (security fix)

server/src/routes/admin.js

@@ -110,8 +110,8 @@ router.post('/devices/batch', requireAdmin, wrap(async (req, res) => {
 
 router.get('/devices/:device_id', requireAdmin, wrap(async (req, res) => {
   const result = await deviceDao.findByIdWithHistory(req.params.device_id)
-  if (!result) return res.json(fail(1005, 'DEVICE_NOT_FOUND'))
-  res.json(ok(result))
+  if (!result || !result.device) return res.json(fail(1005, 'DEVICE_NOT_FOUND'))
+  res.json(ok(Object.assign({}, result.device, { binding_history: result.binding_history, recent_treatments: result.recent_treatments })))
 }))
 
 router.post('/devices/:device_id/unbind', requireAdmin, wrap(async (req, res) => {