feat: implement P0 security and reliability improvements

- bcrypt password hashing with auto-migration from SHA-256
- BLE command retry (3 attempts, 500ms delay, skip on disconnect)
- BLE auto-reconnect with service re-discovery on disconnect
- Treatment page disconnect/reconnect event handling
- Token refresh endpoint with 3-day grace period
- Client-side token auto-refresh when <24h remaining
- Single treatment record detail API with ownership check

miniprogram/app.js

@@ -40,6 +40,7 @@ App({
         success: function (res) {
           http.post('/api/v1/auth/login', { code: res.code }).then(function (data) {
             wx.setStorageSync('token', data.token)
+            wx.setStorageSync('token_expiry', String(Math.floor(Date.now() / 1000) + (data.expires_in || 604800)))
             var app = getApp()
             app.globalData.userInfo = data.user_info
             app.globalData.userId = data.user_id