feat: production readiness — feature gaps + config hardening

Miniprogram:
- Add BLE reconnect button on home page when disconnected
- Add loading states to index, profile, subscribe-plans pages
- Add profile editing (avatar + nickname) with COS upload
- Enable pull-to-refresh on history page
- Fix auto-scan self.options → self.data inconsistency
- Add console.error to silent catch blocks
- Gate 'Simple Peripheral' BLE scan behind __DEV__ flag
- Add production config comment to env.js

Admin console:
- Add empty state '暂无数据' to all 5 list views
- Replace plain text plan input with select dropdown
- Add type="date" to record date filters
- Add production config comment

Server:
- CORS origin restricted in production (env CORS_ORIGIN)
- DB pool size configurable via DB_POOL_SIZE env var
- .env.example updated with WeChat Pay + production fields

server/src/app.js

@@ -1,5 +1,6 @@
 const express = require('express')
 const rateLimit = require('express-rate-limit')
+const config = require('./config')
 const { ok, fail } = require('./lib/response')
 const { authMiddleware } = require('./middleware/auth')
 
@@ -30,7 +31,10 @@ const uploadLimiter = rateLimit({
 
 app.use(express.json())
 app.use((req, res, next) => {
-  res.header('Access-Control-Allow-Origin', '*')
+  const origin = config.nodeEnv === 'production'
+    ? (process.env.CORS_ORIGIN || 'https://admin.vsai.net.cn')
+    : '*'
+  res.header('Access-Control-Allow-Origin', origin)
   res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Device-Id, X-App-Version, X-Platform')
   res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS')
   if (req.method === 'OPTIONS') return res.sendStatus(204)

server/src/lib/db.js

@@ -12,7 +12,7 @@ function getPool() {
       password: config.db.password,
       database: config.db.database,
       waitForConnections: true,
-      connectionLimit: 5,
+      connectionLimit: parseInt(process.env.DB_POOL_SIZE, 10) || 10,
       namedPlaceholders: true,
       timezone: '+08:00'
     })