fix: comprehensive security, quality and consistency fixes

Server:
- Block startup with default JWT secrets in production
- Make subscription verify admin-only (no payment integration yet)
- Add device ownership validation on command/result, event, treatment/sync
- Remove admin token from request body fallback
- Add pageParams boundary protection (pageSize capped at 100)
- Fix COS getObjectUrl to use callback-based Promise
- Add settings key whitelist matching frontend fields
- Add user existence check before subscription creation
- Fix firmware always returning has_update:true
- Replace hardcoded trial subscription with actual DB query
- Extract shared utilities (limitClause, toMysqlDate, formatDate)

Miniprogram:
- Replace fake PD random data with placeholder
- Mark client-timer treatment completions with source field
- Disable mock.js
- Fix BLE listener leaks (save refs, cleanup in onUnload)
- Fix ble.off clearing all listeners (pass specific callback)
- Add BLE disconnect detection via onBLEConnectionStateChange
- Fix subscription status type consistency (number not string)
- Fix scan callback accumulation in ble.js
- Fix history stats accumulation across pages
- Fix subscribe-success/treatment-done hardcoded values
- Fix profile subscription view logic
- Replace purchase flow with admin-contact modal
- Add error logging in command-sync report

Admin console:
- Fix AdminLayout logout (require->import, logout->clearToken)
- Remove all mock data from production request.js
- Replace dashboard fake data with real API calls
- Replace monthly_revenue with subscription_count
- Fix subscription stats fallback (|| -> ??)
- Add token expiry tracking (7 days)
- Unify device status map and subscription status text
- Fix user page record link navigation
- Fix subscription createForm.user_id type handling
- Add error feedback in all empty catch blocks
- Remove unused remember checkbox and uview-plus dependency
- Extract common CSS to shared stylesheet (-900 lines)
- Extract formatDate to shared utils/format.js
- Show real admin name in layout header

admin-console/src/components/AdminLayout.vue

@@ -20,7 +20,7 @@
       <view class="top-header">
         <text class="header-title">{{ pageTitle }}</text>
         <view class="header-right">
-          <text class="header-user">👤 管理员</text>
+          <text class="header-user">👤 {{ adminName }}</text>
           <text class="header-logout" @click="onLogout">退出</text>
         </view>
       </view>
@@ -32,6 +32,8 @@
 </template>
 
 <script>
+import { useUserStore } from '../store/user'
+
 export default {
   props: {
     currentPage: { type: String, default: '' }
@@ -53,6 +55,10 @@ export default {
     pageTitle() {
       const item = this.menuItems.find(m => m.path === this.currentPage)
       return item ? `${item.icon} ${item.label}` : '光子美容仪管理后台'
+    },
+    adminName() {
+      const store = useUserStore()
+      return (store.adminInfo && store.adminInfo.real_name) || '管理员'
     }
   },
   methods: {
@@ -60,9 +66,8 @@ export default {
       uni.redirectTo({ url: path })
     },
     onLogout() {
-      const { useUserStore } = require('../store/user')
       const store = useUserStore()
-      store.logout()
+      store.clearToken()
       uni.reLaunch({ url: '/pages/login/index' })
     }
   }