feat: implement P0 security and reliability improvements

- bcrypt password hashing with auto-migration from SHA-256
- BLE command retry (3 attempts, 500ms delay, skip on disconnect)
- BLE auto-reconnect with service re-discovery on disconnect
- Treatment page disconnect/reconnect event handling
- Token refresh endpoint with 3-day grace period
- Client-side token auto-refresh when <24h remaining
- Single treatment record detail API with ownership check

server/src/routes/admin.js

@@ -1,6 +1,6 @@
 const { one, query, limitClause } = require('../lib/db')
 const { ok, fail } = require('../lib/response')
-const { hashPassword, signAdmin, requireAdmin } = require('../lib/auth')
+const { hashPassword, hashPasswordLegacy, verifyPassword, signAdmin, requireAdmin } = require('../lib/auth')
 const { writeLog } = require('../lib/log')
 
 function pageParams(ctx) {
@@ -14,7 +14,18 @@ function register(router) {
     const username = ctx.body.username || ''
     const password = ctx.body.password || ''
     const admin = await one('SELECT * FROM admin_accounts WHERE username = :username AND status = 1', { username })
-    if (!admin || hashPassword(password, admin.password_salt) !== admin.password_hash) return fail(1001, '用户名或密码错误')
+    if (!admin) return fail(1001, '用户名或密码错误')
+    let matched = verifyPassword(password, admin.password_hash)
+    if (!matched) {
+      // Try legacy SHA-256 verification for migration
+      if (admin.password_salt && hashPasswordLegacy(password, admin.password_salt) === admin.password_hash) {
+        // Auto-migrate to bcrypt
+        const newHash = await hashPassword(password)
+        await query('UPDATE admin_accounts SET password_hash = :password_hash, password_salt = NULL WHERE admin_id = :admin_id', { password_hash: newHash, admin_id: admin.admin_id })
+        matched = true
+      }
+    }
+    if (!matched) return fail(1001, '用户名或密码错误')
     const token = signAdmin(admin)
     await writeLog({ admin_id: admin.admin_id, action: 'admin_login', detail: '管理员登录: ' + username, ip: ctx.ip })
     return ok({ token, admin_id: String(admin.admin_id), username: admin.username, real_name: admin.real_name, role: admin.role })