fix: audit fixes — add checksum_ok to params parse, passthrough control in command-sync

- parseVendorStatus: add checksum_ok verification for 34-byte and 33-byte params
- command-sync.js: passthrough control, current_gain, hold_time from server payload
- Mark buildVendorCommand33 as deprecated alias

miniprogram/services/command-sync.js

@@ -16,7 +16,10 @@ function execute(command) {
         wavelength: payload.wavelength,
         brightness: payload.brightness,
         duration_ms: payload.duration_ms,
-        mode: payload.mode
+        mode: payload.mode,
+        control: payload.control,
+        current_gain: payload.current_gain,
+        hold_time: payload.hold_time
       })
     case ble.CMD.START:
       return ble.startTreatment(payload.region_mask)