fix: resolve 8 bugs and add admin features

Miniprogram:
- Profile "我的设备": show unbind option when device bound, scan when not
- Add device status indicator (已绑定/未绑定) to profile menu

Admin console:
- Login: add @confirm to inputs so Enter key submits the form
- Record detail: wire up 详情 link with modal showing full record info
- Dashboard: add subscription stats row (月卡/年卡/试用/收入)
- Subscription: add 取消 action for active subscriptions
- Format: fix -8h timezone display for UTC ISO date strings

Server:
- POST /api/v1/admin/subscriptions/cancel: cancel active subscriptions
- Dashboard API: include sub_stats (plan counts + monthly revenue)
- IP extraction: add X-Forwarded-For fallback for logging

server/src/routes/admin.js

@@ -59,7 +59,19 @@ function register(router) {
       query('SELECT COUNT(*) AS total FROM treatment_records', {}),
       query('SELECT COUNT(*) AS total FROM subscriptions WHERE status = 1 AND expire_time > NOW()', {})
     ])
-    return ok({ device_count: rows[0][0].total, user_count: rows[1][0].total, treatment_count: rows[2][0].total, subscription_count: rows[3][0].total })
+    const subStats = await query('SELECT ' +
+      'SUM(CASE WHEN plan = \'monthly\' AND status = 1 AND expire_time > NOW() THEN 1 ELSE 0 END) AS monthly_count, ' +
+      'SUM(CASE WHEN plan = \'yearly\' AND status = 1 AND expire_time > NOW() THEN 1 ELSE 0 END) AS yearly_count, ' +
+      'SUM(CASE WHEN plan = \'trial\' AND status = 1 AND expire_time > NOW() THEN 1 ELSE 0 END) AS trial_count, ' +
+      'COALESCE(SUM(CASE WHEN MONTH(start_time) = MONTH(NOW()) AND YEAR(start_time) = YEAR(NOW()) THEN amount ELSE 0 END), 0) AS monthly_revenue ' +
+      'FROM subscriptions', {})
+    return ok({
+      device_count: rows[0][0].total,
+      user_count: rows[1][0].total,
+      treatment_count: rows[2][0].total,
+      subscription_count: rows[3][0].total,
+      sub_stats: subStats[0] || {}
+    })
   })
 
   router.get('/api/v1/admin/devices', async ctx => {
@@ -246,6 +258,17 @@ function register(router) {
     return ok({ message: 'success' })
   })
 
+  router.post('/api/v1/admin/subscriptions/cancel', async ctx => {
+    const admin = await requireAdmin(ctx)
+    if (!admin) return fail(1002, '未授权，请重新登录')
+    const subscriptionId = ctx.body.subscription_id
+    if (!subscriptionId) return fail(2001, 'subscription_id required')
+    const result = await query('UPDATE subscriptions SET status = 3 WHERE subscription_id = :subscription_id AND status = 1', { subscription_id: subscriptionId })
+    if (result.affectedRows === 0) return fail(2001, '未找到有效订阅')
+    await writeLog({ admin_id: admin.admin_id, action: 'subscription_cancel', detail: '取消订阅 #' + subscriptionId, ip: ctx.ip })
+    return ok({ message: 'success' })
+  })
+
   router.get('/api/v1/admin/records', async ctx => {
     const admin = await requireAdmin(ctx)
     if (!admin) return fail(1002, '未授权，请重新登录')