feat: production readiness — feature gaps + config hardening

Miniprogram:
- Add BLE reconnect button on home page when disconnected
- Add loading states to index, profile, subscribe-plans pages
- Add profile editing (avatar + nickname) with COS upload
- Enable pull-to-refresh on history page
- Fix auto-scan self.options → self.data inconsistency
- Add console.error to silent catch blocks
- Gate 'Simple Peripheral' BLE scan behind __DEV__ flag
- Add production config comment to env.js

Admin console:
- Add empty state '暂无数据' to all 5 list views
- Replace plain text plan input with select dropdown
- Add type="date" to record date filters
- Add production config comment

Server:
- CORS origin restricted in production (env CORS_ORIGIN)
- DB pool size configurable via DB_POOL_SIZE env var
- .env.example updated with WeChat Pay + production fields

server/.env.example

@@ -22,3 +22,15 @@ ADMIN_JWT_SECRET=replace-with-a-different-long-random-secret
 
 ADMIN_USERNAME=admin
 ADMIN_PASSWORD=admin
+
+CORS_ORIGIN=https://admin.vsai.net.cn
+
+WX_MCH_ID=
+WX_MCH_API_V3_KEY=
+WX_MCH_SERIAL_NO=
+WX_MCH_PRIVATE_KEY_PATH=
+WX_PAY_NOTIFY_URL=
+
+DB_POOL_SIZE=10
+
+COS_CDN_DOMAIN=tx.vsai.net.cn