feat: implement P0 security and reliability improvements

- bcrypt password hashing with auto-migration from SHA-256
- BLE command retry (3 attempts, 500ms delay, skip on disconnect)
- BLE auto-reconnect with service re-discovery on disconnect
- Treatment page disconnect/reconnect event handling
- Token refresh endpoint with 3-day grace period
- Client-side token auto-refresh when <24h remaining
- Single treatment record detail API with ownership check

server/src/lib/auth.js

@@ -1,12 +1,21 @@
 const crypto = require('crypto')
 const jwt = require('jsonwebtoken')
+const bcrypt = require('bcryptjs')
 const config = require('../config')
 const { one } = require('./db')
 
-function hashPassword(password, salt) {
+function hashPasswordLegacy(password, salt) {
   return crypto.createHash('sha256').update(String(password) + ':' + salt).digest('hex')
 }
 
+function hashPassword(password) {
+  return bcrypt.hashSync(password, 10)
+}
+
+function verifyPassword(password, hash) {
+  return bcrypt.compareSync(password, hash)
+}
+
 function randomHex(bytes) {
   return crypto.randomBytes(bytes).toString('hex')
 }
@@ -49,4 +58,4 @@ async function requireAdmin(ctx) {
   }
 }
 
-module.exports = { hashPassword, randomHex, signUser, signAdmin, requireUser, requireAdmin }
+module.exports = { hashPassword, hashPasswordLegacy, verifyPassword, randomHex, signUser, signAdmin, readBearer, requireUser, requireAdmin }