fix: comprehensive security, quality and consistency fixes

Server:
- Block startup with default JWT secrets in production
- Make subscription verify admin-only (no payment integration yet)
- Add device ownership validation on command/result, event, treatment/sync
- Remove admin token from request body fallback
- Add pageParams boundary protection (pageSize capped at 100)
- Fix COS getObjectUrl to use callback-based Promise
- Add settings key whitelist matching frontend fields
- Add user existence check before subscription creation
- Fix firmware always returning has_update:true
- Replace hardcoded trial subscription with actual DB query
- Extract shared utilities (limitClause, toMysqlDate, formatDate)

Miniprogram:
- Replace fake PD random data with placeholder
- Mark client-timer treatment completions with source field
- Disable mock.js
- Fix BLE listener leaks (save refs, cleanup in onUnload)
- Fix ble.off clearing all listeners (pass specific callback)
- Add BLE disconnect detection via onBLEConnectionStateChange
- Fix subscription status type consistency (number not string)
- Fix scan callback accumulation in ble.js
- Fix history stats accumulation across pages
- Fix subscribe-success/treatment-done hardcoded values
- Fix profile subscription view logic
- Replace purchase flow with admin-contact modal
- Add error logging in command-sync report

Admin console:
- Fix AdminLayout logout (require->import, logout->clearToken)
- Remove all mock data from production request.js
- Replace dashboard fake data with real API calls
- Replace monthly_revenue with subscription_count
- Fix subscription stats fallback (|| -> ??)
- Add token expiry tracking (7 days)
- Unify device status map and subscription status text
- Fix user page record link navigation
- Fix subscription createForm.user_id type handling
- Add error feedback in all empty catch blocks
- Remove unused remember checkbox and uview-plus dependency
- Extract common CSS to shared stylesheet (-900 lines)
- Extract formatDate to shared utils/format.js
- Show real admin name in layout header

admin-console/src/pages/user-detail/index.vue

@@ -82,6 +82,7 @@
 
 <script>
 import { get } from '../../utils/request'
+import { formatDateShort } from '../../utils/format'
 import AdminLayout from '../../components/AdminLayout.vue'
 
 export default {
@@ -118,14 +119,14 @@ export default {
       const map = { yearly: '年卡', monthly: '月卡', trial: '试用' }
       return map[type] || '-'
     },
-    formatDate(d) {
-      return d ? d.slice(0, 10) : '-'
-    }
+    formatDate: formatDateShort
   }
 }
 </script>
 
 <style scoped>
+@import '../../styles/common.css';
+
 .back-link {
   color: #E6508C;
   font-size: 14px;
@@ -133,13 +134,6 @@ export default {
   cursor: pointer;
 }
 
-.page-card {
-  background: #fff;
-  border-radius: 8px;
-  padding: 20px;
-  margin-bottom: 16px;
-}
-
 .page-header {
   display: flex;
   justify-content: space-between;
@@ -191,18 +185,9 @@ export default {
 }
 
 .badge {
-  display: inline-block;
-  padding: 2px 8px;
-  border-radius: 4px;
-  font-size: 12px;
   margin-top: 4px;
 }
 
-.badge-success {
-  background: #f6ffed;
-  color: #52c41a;
-}
-
 .stats-row {
   display: flex;
   gap: 16px;
@@ -266,40 +251,6 @@ export default {
   color: #333;
 }
 
-.data-table {
-  width: 100%;
-}
-
-.t-header {
-  background: #fafafa;
-}
-
-.t-row {
-  display: flex;
-  align-items: center;
-  padding: 12px 0;
-  border-bottom: 1px solid #f0f0f0;
-}
-
-.t-th {
-  font-size: 14px;
-  color: #666;
-  font-weight: 500;
-}
-
-.t-td {
-  font-size: 14px;
-  color: #333;
-}
-
-.flex1 {
-  flex: 1;
-}
-
-.flex2 {
-  flex: 2;
-}
-
 .view-all {
   text-align: center;
   margin-top: 16px;
@@ -311,18 +262,4 @@ export default {
   cursor: pointer;
 }
 
-.btn-primary {
-  background: #E6508C;
-  color: #fff;
-  border: none;
-  border-radius: 6px;
-  cursor: pointer;
-}
-
-.btn-sm {
-  height: 32px;
-  padding: 0 16px;
-  font-size: 14px;
-  line-height: 32px;
-}
 </style>