fix: comprehensive security, quality and consistency fixes

Server:
- Block startup with default JWT secrets in production
- Make subscription verify admin-only (no payment integration yet)
- Add device ownership validation on command/result, event, treatment/sync
- Remove admin token from request body fallback
- Add pageParams boundary protection (pageSize capped at 100)
- Fix COS getObjectUrl to use callback-based Promise
- Add settings key whitelist matching frontend fields
- Add user existence check before subscription creation
- Fix firmware always returning has_update:true
- Replace hardcoded trial subscription with actual DB query
- Extract shared utilities (limitClause, toMysqlDate, formatDate)

Miniprogram:
- Replace fake PD random data with placeholder
- Mark client-timer treatment completions with source field
- Disable mock.js
- Fix BLE listener leaks (save refs, cleanup in onUnload)
- Fix ble.off clearing all listeners (pass specific callback)
- Add BLE disconnect detection via onBLEConnectionStateChange
- Fix subscription status type consistency (number not string)
- Fix scan callback accumulation in ble.js
- Fix history stats accumulation across pages
- Fix subscribe-success/treatment-done hardcoded values
- Fix profile subscription view logic
- Replace purchase flow with admin-contact modal
- Add error logging in command-sync report

Admin console:
- Fix AdminLayout logout (require->import, logout->clearToken)
- Remove all mock data from production request.js
- Replace dashboard fake data with real API calls
- Replace monthly_revenue with subscription_count
- Fix subscription stats fallback (|| -> ??)
- Add token expiry tracking (7 days)
- Unify device status map and subscription status text
- Fix user page record link navigation
- Fix subscription createForm.user_id type handling
- Add error feedback in all empty catch blocks
- Remove unused remember checkbox and uview-plus dependency
- Extract common CSS to shared stylesheet (-900 lines)
- Extract formatDate to shared utils/format.js
- Show real admin name in layout header

server/src/routes/firmware.js

@@ -4,20 +4,16 @@ const { requireUser, requireAdmin } = require('../lib/auth')
 const { getObjectUrl } = require('../lib/cos')
 const { writeLog } = require('../lib/log')
 
-function adminOnly(ctx) {
-  return requireAdmin(ctx)
-}
-
 function register(router) {
   router.get('/api/v1/admin/firmware', async ctx => {
-    const admin = await adminOnly(ctx)
+    const admin = await requireAdmin(ctx)
     if (!admin) return fail(1002, '未授权，请重新登录')
     const rows = await query('SELECT firmware_id, version, device_type, cos_key, size_bytes, sha256, status, created_at FROM firmware_files ORDER BY created_at DESC', {})
     return ok({ records: rows, total: rows.length })
   })
 
   router.post('/api/v1/admin/firmware', async ctx => {
-    const admin = await adminOnly(ctx)
+    const admin = await requireAdmin(ctx)
     if (!admin) return fail(1002, '未授权，请重新登录')
     const version = String(ctx.body.version || '').trim()
     const cosKey = String(ctx.body.cos_key || '').trim()
@@ -38,7 +34,7 @@ function register(router) {
   })
 
   router.post('/api/v1/admin/firmware/:firmware_id/status', async ctx => {
-    const admin = await adminOnly(ctx)
+    const admin = await requireAdmin(ctx)
     if (!admin) return fail(1002, '未授权，请重新登录')
     const firmwareId = parseInt(ctx.params.firmware_id, 10)
     const status = Number(ctx.body.status) === 1 ? 1 : 0
@@ -53,12 +49,14 @@ function register(router) {
     if (!user) return fail(1001, 'invalid_token')
     const firmware = await one('SELECT * FROM firmware_files WHERE status = 1 ORDER BY created_at DESC LIMIT 1', {})
     if (!firmware) return ok({ has_update: false })
+    const currentVersion = ctx.query.current_version || ''
+    if (currentVersion && currentVersion === firmware.version) return ok({ has_update: false })
     return ok({
       has_update: true,
       version: firmware.version,
       size_bytes: firmware.size_bytes,
       sha256: firmware.sha256,
-      download_url: getObjectUrl(firmware.cos_key, 600)
+      download_url: await getObjectUrl(firmware.cos_key, 600)
     })
   })
 }