fix: audit fixes — treatment sync, avatar upload, code consistency

- Always sync treatment end (not just early stop), pass start/end times
- treatment-done uses api.syncTreatment instead of raw http.post
- Move getApp() from module level to onLoad in treatment-done
- Avatar upload only returns URL, no longer updates profile directly
- COS CDN domain configurable via COS_CDN_DOMAIN env var
- Fix operator precedence in request.js token expiry check
- Remove unused result variable from COS putObject

miniprogram/pages/treating/treating.js

@@ -175,14 +175,14 @@ Page({
 
   finishAsComplete: function () {
     var elapsed = Math.min(this.data.duration, Date.now() - this.data.startedAt)
-    if (elapsed < this.data.duration) {
-      this.syncTreatmentEnd(elapsed)
-    }
+    this.syncTreatmentEnd(elapsed)
     this.onComplete({
       session_id: this._sessionId,
       regions: this.data.regions,
       total_duration_ms: elapsed,
       avg_pd: 0,
+      start_time: new Date(this.data.startedAt).toISOString(),
+      end_time: new Date(this.data.startedAt + elapsed).toISOString(),
       source: 'client_timer'
     })
   },