fix: comprehensive security, quality and consistency fixes

Server:
- Block startup with default JWT secrets in production
- Make subscription verify admin-only (no payment integration yet)
- Add device ownership validation on command/result, event, treatment/sync
- Remove admin token from request body fallback
- Add pageParams boundary protection (pageSize capped at 100)
- Fix COS getObjectUrl to use callback-based Promise
- Add settings key whitelist matching frontend fields
- Add user existence check before subscription creation
- Fix firmware always returning has_update:true
- Replace hardcoded trial subscription with actual DB query
- Extract shared utilities (limitClause, toMysqlDate, formatDate)

Miniprogram:
- Replace fake PD random data with placeholder
- Mark client-timer treatment completions with source field
- Disable mock.js
- Fix BLE listener leaks (save refs, cleanup in onUnload)
- Fix ble.off clearing all listeners (pass specific callback)
- Add BLE disconnect detection via onBLEConnectionStateChange
- Fix subscription status type consistency (number not string)
- Fix scan callback accumulation in ble.js
- Fix history stats accumulation across pages
- Fix subscribe-success/treatment-done hardcoded values
- Fix profile subscription view logic
- Replace purchase flow with admin-contact modal
- Add error logging in command-sync report

Admin console:
- Fix AdminLayout logout (require->import, logout->clearToken)
- Remove all mock data from production request.js
- Replace dashboard fake data with real API calls
- Replace monthly_revenue with subscription_count
- Fix subscription stats fallback (|| -> ??)
- Add token expiry tracking (7 days)
- Unify device status map and subscription status text
- Fix user page record link navigation
- Fix subscription createForm.user_id type handling
- Add error feedback in all empty catch blocks
- Remove unused remember checkbox and uview-plus dependency
- Extract common CSS to shared stylesheet (-900 lines)
- Extract formatDate to shared utils/format.js
- Show real admin name in layout header

server/src/routes/device.js

@@ -2,10 +2,7 @@ const { one, query, transaction } = require('../lib/db')
 const { ok, fail } = require('../lib/response')
 const { requireUser, randomHex } = require('../lib/auth')
 const { writeLog } = require('../lib/log')
-
-function formatDate(date) {
-  return date.toISOString().slice(0, 19).replace('T', ' ')
-}
+const { formatDate } = require('../lib/utils')
 
 async function ensureTrial(conn, userId) {
   const [subs] = await conn.execute('SELECT subscription_id FROM subscriptions WHERE user_id = ? AND status = 1 AND expire_time > NOW() LIMIT 1', [userId])
@@ -40,7 +37,8 @@ function register(router) {
     if (result.invalid) return fail(1005, 'DEVICE_NOT_FOUND')
     if (result.duplicated) return fail(2001, '已绑定设备', { device_id: result.device_id })
     await writeLog({ user_id: user.user_id, action: 'device_bind_request', detail: '申请绑定设备: ' + deviceId, ip: ctx.ip })
-    return ok(Object.assign(result, { subscription: { plan: 'trial', remaining_days: 7 } }))
+    const sub = await one('SELECT plan, GREATEST(DATEDIFF(expire_time, NOW()), 0) AS remaining_days FROM subscriptions WHERE user_id = :user_id AND status = 1 AND expire_time > NOW() ORDER BY expire_time DESC LIMIT 1', { user_id: user.user_id })
+    return ok(Object.assign(result, { subscription: sub ? { plan: sub.plan, remaining_days: sub.remaining_days } : { plan: 'none', remaining_days: 0 } }))
   })
 
   router.post('/api/v1/device/bind/confirm', async ctx => {
@@ -62,7 +60,8 @@ function register(router) {
     })
     if (!updated) return fail(2001, 'bind_token invalid or expired')
     await writeLog({ user_id: user.user_id, action: 'device_bind_confirm', detail: '确认绑定设备: ' + deviceId, ip: ctx.ip })
-    return ok({ message: 'success', subscription: { plan: 'trial', remaining_days: 7 } })
+    const sub = await one('SELECT plan, GREATEST(DATEDIFF(expire_time, NOW()), 0) AS remaining_days FROM subscriptions WHERE user_id = :user_id AND status = 1 AND expire_time > NOW() ORDER BY expire_time DESC LIMIT 1', { user_id: user.user_id })
+    return ok({ message: 'success', subscription: sub ? { plan: sub.plan, remaining_days: sub.remaining_days } : { plan: 'none', remaining_days: 0 } })
   })
 
   router.post('/api/v1/device/unbind', async ctx => {
@@ -107,6 +106,8 @@ function register(router) {
     const commandId = parseInt(ctx.body.command_id || ctx.body.seq, 10)
     const success = ctx.body.success !== false
     if (!commandId) return fail(2001, 'command_id required')
+    const cmd = await one('SELECT dc.command_id FROM device_commands dc JOIN bindings b ON b.device_id = dc.device_id AND b.user_id = :user_id AND b.bind_status = 1 WHERE dc.command_id = :command_id', { user_id: user.user_id, command_id: commandId })
+    if (!cmd) return fail(1006, 'device_not_bound')
     await query('UPDATE device_commands SET status = :status, finished_at = NOW(), result_json = :result_json WHERE command_id = :command_id', {
       command_id: commandId,
       status: success ? 3 : 4,
@@ -131,6 +132,8 @@ function register(router) {
     if (!user) return fail(1001, 'invalid_token')
     const deviceId = String(ctx.body.device_id || '').trim()
     if (!deviceId) return fail(2001, 'device_id required')
+    const binding = await one('SELECT binding_id FROM bindings WHERE user_id = :user_id AND device_id = :device_id AND bind_status = 1', { user_id: user.user_id, device_id: deviceId })
+    if (!binding) return fail(1006, 'device_not_bound')
     await query(
       'INSERT INTO device_events (device_id, user_id, event_type, error_code, temperature, payload_json) VALUES (:device_id, :user_id, :event_type, :error_code, :temperature, :payload_json)',
       {