feat: implement P0 security and reliability improvements

- bcrypt password hashing with auto-migration from SHA-256
- BLE command retry (3 attempts, 500ms delay, skip on disconnect)
- BLE auto-reconnect with service re-discovery on disconnect
- Treatment page disconnect/reconnect event handling
- Token refresh endpoint with 3-day grace period
- Client-side token auto-refresh when <24h remaining
- Single treatment record detail API with ownership check

server/package.json

@@ -9,6 +9,7 @@
     "db:init": "node scripts/init-db.js"
   },
   "dependencies": {
+    "bcryptjs": "^2.4.3",
     "cos-nodejs-sdk-v5": "^2.14.7",
     "dotenv": "^16.4.5",
     "jsonwebtoken": "^9.0.2",