fix: BLE protocol handling matches actual device behavior

- discoverChars uses properties (write/notify) to distinguish FFE1
  command characteristic from FFE1 service UUID
- handleValueChange: vendor_33 mode emits vendor_status (FFE4 heartbeat)
  and vendor_data separately, no longer tries parseFrame on raw bytes
- parseVendorStatus handles 1-byte heartbeat and 33-byte state readback
  with proper IO1-IO5 field parsing

miniprogram/services/ble/protocol.js

@@ -196,11 +196,28 @@ function buildVendorCommand33(options) {
 
 function parseVendorStatus(buffer) {
   var bytes = bufferToBytes(buffer)
-  return {
-    mode_state: bytes.length > 0 ? bytes[0] : MODE_STATE.IDLE,
-    raw_bytes: bytes,
-    raw_hex: bytesToHex(bytes)
+  if (bytes.length === 1) {
+    return { heartbeat: bytes[0], is_heartbeat: true, raw_hex: bytesToHex(bytes) }
   }
+  if (bytes.length === 33) {
+    var ios = []
+    for (var i = 0; i < 5; i++) {
+      var off = i * 6
+      ios.push({
+        red: bytes[off], infrared: bytes[off + 1],
+        uv: bytes[off + 2], warm_yellow: bytes[off + 3],
+        gain: (bytes[off + 4] << 8) | bytes[off + 5]
+      })
+    }
+    return {
+      is_heartbeat: false,
+      ios: ios,
+      hold_time: (bytes[30] << 8) | bytes[31],
+      checksum: bytes[32],
+      raw_hex: bytesToHex(bytes)
+    }
+  }
+  return { is_heartbeat: false, raw_bytes: bytes, raw_hex: bytesToHex(bytes) }
 }
 
 // --- frame encoding/decoding ---