fix(mp): Phase 0 基础设施修复 — secureGet 解密 + Storage 一致性

- secureGet: 移除错误的 startsWith 条件，始终尝试 XOR 解密
- request.ts: current_patient_id 读取改用 safeGet，清理改用 secureRemove
- health.ts: getTodaySummary 使用 getCachedPatientId 替代直接 Storage
- auth.ts: analytics_queue 清理改用明文 Taro.removeStorageSync

apps/miniprogram/src/services/health.ts

@@ -1,5 +1,5 @@
 import Taro from '@tarojs/taro';
-import { api } from './request';
+import { api, getCachedPatientId } from './request';
 
 export interface VitalSignInput {
   indicator_type: string;
@@ -17,7 +17,7 @@ export interface TodaySummary {
 }
 
 export async function getTodaySummary(patientId?: string) {
-  const pid = patientId || Taro.getStorageSync('current_patient_id') || '';
+  const pid = patientId || getCachedPatientId() || '';
   const params: Record<string, string> = {};
   if (pid) params.patient_id = pid;
   return api.get<TodaySummary>('/health/vital-signs/today', params);

apps/miniprogram/src/services/request.ts

@@ -146,7 +146,7 @@ function refreshHeadersCache(): void {
   cachedToken = safeGet('access_token');
   cachedTenantId = safeGet('tenant_id');
   if (!responseCache.getPatientId()) {
-    responseCache.setPatientId(Taro.getStorageSync('current_patient_id') || '');
+    responseCache.setPatientId(safeGet('current_patient_id') || '');
   }
   headersCacheTs = Date.now();
 }
@@ -214,8 +214,8 @@ async function doRefresh(): Promise<boolean> {
   secureRemove('user_roles');
   secureRemove('tenant_id');
   secureRemove('wechat_openid');
-  Taro.removeStorageSync('current_patient');
-  Taro.removeStorageSync('current_patient_id');
+  secureRemove('current_patient');
+  secureRemove('current_patient_id');
   clearRequestCache();
   responseCache.setPatientId('');
   headersCacheTs = 0;