fix: comprehensive security, quality and consistency fixes

Server:
- Block startup with default JWT secrets in production
- Make subscription verify admin-only (no payment integration yet)
- Add device ownership validation on command/result, event, treatment/sync
- Remove admin token from request body fallback
- Add pageParams boundary protection (pageSize capped at 100)
- Fix COS getObjectUrl to use callback-based Promise
- Add settings key whitelist matching frontend fields
- Add user existence check before subscription creation
- Fix firmware always returning has_update:true
- Replace hardcoded trial subscription with actual DB query
- Extract shared utilities (limitClause, toMysqlDate, formatDate)

Miniprogram:
- Replace fake PD random data with placeholder
- Mark client-timer treatment completions with source field
- Disable mock.js
- Fix BLE listener leaks (save refs, cleanup in onUnload)
- Fix ble.off clearing all listeners (pass specific callback)
- Add BLE disconnect detection via onBLEConnectionStateChange
- Fix subscription status type consistency (number not string)
- Fix scan callback accumulation in ble.js
- Fix history stats accumulation across pages
- Fix subscribe-success/treatment-done hardcoded values
- Fix profile subscription view logic
- Replace purchase flow with admin-contact modal
- Add error logging in command-sync report

Admin console:
- Fix AdminLayout logout (require->import, logout->clearToken)
- Remove all mock data from production request.js
- Replace dashboard fake data with real API calls
- Replace monthly_revenue with subscription_count
- Fix subscription stats fallback (|| -> ??)
- Add token expiry tracking (7 days)
- Unify device status map and subscription status text
- Fix user page record link navigation
- Fix subscription createForm.user_id type handling
- Add error feedback in all empty catch blocks
- Remove unused remember checkbox and uview-plus dependency
- Extract common CSS to shared stylesheet (-900 lines)
- Extract formatDate to shared utils/format.js
- Show real admin name in layout header

server/src/routes/subscription.js

@@ -1,6 +1,6 @@
-const { one, query } = require('../lib/db')
+const { one, query, transaction } = require('../lib/db')
 const { ok, fail } = require('../lib/response')
-const { requireUser } = require('../lib/auth')
+const { requireUser, requireAdmin } = require('../lib/auth')
 const { writeLog } = require('../lib/log')
 
 const PLANS = {
@@ -26,21 +26,22 @@ function register(router) {
     return ok({ order_id: orderId, payment_params: {}, plan, amount: PLANS[plan].amount })
   })
 
+  // Temporary: admin-only until payment integration
   router.post('/api/v1/subscription/verify', async ctx => {
-    const user = await requireUser(ctx)
-    if (!user) return fail(1001, 'invalid_token')
+    const admin = await requireAdmin(ctx)
+    if (!admin) return fail(1002, '未授权，请重新登录')
+    const userId = ctx.body.user_id
+    if (!userId) return fail(2001, 'user_id required')
     const plan = ctx.body.plan || ctx.body.plan_type || 'monthly'
     if (!PLANS[plan]) return fail(2001, 'invalid plan')
     const p = PLANS[plan]
-    await query('UPDATE subscriptions SET status = 2 WHERE user_id = :user_id AND status = 1', { user_id: user.user_id })
-    await query('INSERT INTO subscriptions (user_id, plan, status, amount, order_id, start_time, expire_time) VALUES (:user_id, :plan, 1, :amount, :order_id, NOW(), DATE_ADD(NOW(), INTERVAL :days DAY))', {
-      user_id: user.user_id,
-      plan,
-      amount: p.amount,
-      order_id: ctx.body.order_id || 'ORD' + Date.now(),
-      days: p.days
+    await transaction(async conn => {
+      await conn.execute('UPDATE subscriptions SET status = 2 WHERE user_id = ? AND status = 1', [userId])
+      await conn.execute('INSERT INTO subscriptions (user_id, plan, status, amount, order_id, start_time, expire_time) VALUES (?, ?, 1, ?, ?, NOW(), DATE_ADD(NOW(), INTERVAL ? DAY))', [
+        userId, plan, p.amount, ctx.body.order_id || 'ORD' + Date.now(), p.days
+      ])
     })
-    await writeLog({ user_id: user.user_id, action: 'subscription_verify', detail: '订阅生效: ' + plan, ip: ctx.ip })
+    await writeLog({ admin_id: admin.admin_id, action: 'subscription_verify', detail: '订阅生效: ' + plan + ' user:' + userId, ip: ctx.ip })
     return ok({ status: 'active', plan, remaining_days: p.days })
   })
 }