fix: audit fixes — treatment sync, avatar upload, code consistency

- Always sync treatment end (not just early stop), pass start/end times
- treatment-done uses api.syncTreatment instead of raw http.post
- Move getApp() from module level to onLoad in treatment-done
- Avatar upload only returns URL, no longer updates profile directly
- COS CDN domain configurable via COS_CDN_DOMAIN env var
- Fix operator precedence in request.js token expiry check
- Remove unused result variable from COS putObject

server/src/config.js

@@ -15,7 +15,8 @@ const config = {
     secretId: process.env.TENCENT_SECRET_ID,
     secretKey: process.env.TENCENT_SECRET_KEY,
     bucket: process.env.COS_BUCKET || 'jw-bucket-1426323813',
-    region: process.env.COS_REGION || process.env.TENCENT_REGION || 'ap-guangzhou'
+    region: process.env.COS_REGION || process.env.TENCENT_REGION || 'ap-guangzhou',
+    cdnDomain: process.env.COS_CDN_DOMAIN || 'tx.vsai.net.cn'
   },
   wechat: {
     appid: process.env.WECHAT_APPID,