fix: audit fixes — treatment sync, avatar upload, code consistency

- Always sync treatment end (not just early stop), pass start/end times
- treatment-done uses api.syncTreatment instead of raw http.post
- Move getApp() from module level to onLoad in treatment-done
- Avatar upload only returns URL, no longer updates profile directly
- COS CDN domain configurable via COS_CDN_DOMAIN env var
- Fix operator precedence in request.js token expiry check
- Remove unused result variable from COS putObject

miniprogram/utils/request.js

@@ -68,7 +68,7 @@ function httpRequest(options) {
         success: function (res) {
           if (res.data && res.data.code === 0) {
             resolve(res.data.data)
-          } else if (res.data && res.data.code === 1001 || res.data && res.data.code === 1002) {
+          } else if (res.data && (res.data.code === 1001 || res.data.code === 1002)) {
             wx.removeStorageSync('token')
             wx.removeStorageSync('token_expiry')
             wx.reLaunch({ url: '/pages/login/login' })