fix: audit fixes — add checksum_ok to params parse, passthrough control in command-sync

- parseVendorStatus: add checksum_ok verification for 34-byte and 33-byte params
- command-sync.js: passthrough control, current_gain, hold_time from server payload
- Mark buildVendorCommand33 as deprecated alias

miniprogram/services/ble/protocol.js

@@ -206,6 +206,7 @@ function buildVendorCommand(options) {
   return bytes
 }
 
+// deprecated: alias kept for backward compat, actually outputs 34 bytes
 function buildVendorCommand33(options) {
   return buildVendorCommand(options)
 }
@@ -259,6 +260,7 @@ function parseVendorStatus(buffer) {
         gain: (bytes[off34 + 4] << 8) | bytes[off34 + 5]
       })
     }
+    var expected34 = xorChecksum(bytes.slice(0, 33))
     return {
       type: 'params',
       is_heartbeat: false,
@@ -266,6 +268,7 @@ function parseVendorStatus(buffer) {
       hold_time: (bytes[30] << 8) | bytes[31],
       control: bytes[32],
       checksum: bytes[33],
+      checksum_ok: expected34 === bytes[33],
       raw_hex: bytesToHex(bytes)
     }
   }
@@ -279,6 +282,7 @@ function parseVendorStatus(buffer) {
         gain: (bytes[off + 4] << 8) | bytes[off + 5]
       })
     }
+    var expected33 = xorChecksum(bytes.slice(0, 32))
     return {
       type: 'params',
       is_heartbeat: false,
@@ -286,6 +290,7 @@ function parseVendorStatus(buffer) {
       hold_time: (bytes[30] << 8) | bytes[31],
       control: -1,
       checksum: bytes[32],
+      checksum_ok: expected33 === bytes[32],
       raw_hex: bytesToHex(bytes)
     }
   }