fix: resolve final audit issues

- firmware route: extract insertId from ResultSetHeader correctly
- admin device detail: add null check and flatten response to match
  frontend's expected field structure
- device command result: add ownership verification before finishing
  command (security fix)

server/src/routes/device.js

@@ -102,8 +102,9 @@ router.post('/device/command/result', requireUser, wrap(async (req, res) => {
   const commandId = parseInt(req.body.command_id || req.body.seq, 10)
   const success = req.body.success !== false
   if (!commandId) return res.json(fail(2001, 'command_id required'))
-  // commandDao.finish verifies device ownership via user binding
-  await commandDao.finish(commandId, success, JSON.stringify(req.body), req.user.user_id)
+  const cmd = await commandDao.findByIdForUser(commandId, req.user.user_id)
+  if (!cmd) return res.json(fail(1006, 'device_not_bound'))
+  await commandDao.finish(commandId, success, JSON.stringify(req.body))
   res.json(ok({ message: 'success' }))
 }))