fix: 全面 QA 审计修复 — 安全加固/代码质量/跨平台一致性/测试覆盖

Phase 0 安全热修复 (CRITICAL):
- 外部化微信 appid/secret 到 ERP__WECHAT__APPID/SECRET 环境变量
- 正确连接 HealthCrypto 到 ERP__HEALTH__AES_KEY/HMAC_KEY 环境变量
- 外部化小程序加密密钥到 TARO_APP_ENCRYPTION_KEY 环境变量
- 移除小程序 auth store 中的敏感信息 console.log

Phase 1 安全加固:
- 微信自动注册 display_name 添加 sanitize 防止 XSS
- 测试数据库凭据改为从 TEST_DB_URL 环境变量读取

Phase 2 代码质量:
- 提取 useThemeMode hook 消除 22 处重复暗色模式检测
- 提取共享健康常量到 constants/health.ts
- 拆分 patient_service.rs 脱敏函数到 masking.rs
- 移除未使用的 i18next/react-i18next 依赖
- 移除未使用的 api/errors.ts 和 erp-auth/anyhow 依赖

Phase 3 测试覆盖:
- 新增 5 个患者模块集成测试 (CRUD/租户隔离/验证/软删除)

Phase 4 跨平台一致性:
- 统一小程序 Patient.birthday → birth_date 匹配后端
- 统一小程序 Appointment.time_slot → start_time/end_time 匹配后端

Phase 5 架构:
- 微信登录添加多租户 TODO 注释
- 更新 wiki/infrastructure.md 环境变量文档

apps/web/src/pages/workflow/CompletedTasks.tsx

@@ -1,7 +1,8 @@
 import { useEffect, useCallback, useState } from 'react';
-import { Table, Tag, theme } from 'antd';
+import { Table, Tag } from 'antd';
 import type { ColumnsType } from 'antd/es/table';
 import { listCompletedTasks, type TaskInfo } from '../../api/workflowTasks';
+import { useThemeMode } from '../../hooks/useThemeMode';
 
 const outcomeStyles: Record<string, { bg: string; color: string; text: string }> = {
   approved: { bg: '#ECFDF5', color: '#059669', text: '同意' },
@@ -14,8 +15,7 @@ export default function CompletedTasks() {
   const [total, setTotal] = useState(0);
   const [page, setPage] = useState(1);
   const [loading, setLoading] = useState(false);
-  const { token } = theme.useToken();
-  const isDark = token.colorBgContainer === '#111827' || token.colorBgContainer === 'rgb(17, 24, 39)';
+  const isDark = useThemeMode();
 
   const fetchData = useCallback(async () => {
     setLoading(true);

apps/web/src/pages/workflow/InstanceMonitor.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useCallback, useState } from 'react';
-import { Button, message, Modal, Table, Tag, theme } from 'antd';
+import { Button, message, Modal, Table, Tag } from 'antd';
 import { EyeOutlined, PauseCircleOutlined, PlayCircleOutlined, StopOutlined } from '@ant-design/icons';
 import type { ColumnsType } from 'antd/es/table';
 import {
@@ -11,6 +11,7 @@ import {
 } from '../../api/workflowInstances';
 import { getProcessDefinition, type NodeDef, type EdgeDef } from '../../api/workflowDefinitions';
 import ProcessViewer from './ProcessViewer';
+import { useThemeMode } from '../../hooks/useThemeMode';
 
 const statusStyles: Record<string, { bg: string; color: string; text: string }> = {
   running: { bg: '#eff6ff', color: '#2563eb', text: '运行中' },
@@ -30,8 +31,7 @@ export default function InstanceMonitor() {
   const [viewerEdges, setViewerEdges] = useState<EdgeDef[]>([]);
   const [activeNodeIds, setActiveNodeIds] = useState<string[]>([]);
   const [viewerLoading, setViewerLoading] = useState(false);
-  const { token } = theme.useToken();
-  const isDark = token.colorBgContainer === '#111827' || token.colorBgContainer === 'rgb(17, 24, 39)';
+  const isDark = useThemeMode();
 
   const fetchData = useCallback(async () => {
     setLoading(true);

apps/web/src/pages/workflow/PendingTasks.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useCallback, useState } from 'react';
-import { Button, Input, message, Modal, Space, Table, Tag, theme } from 'antd';
+import { Button, Input, message, Modal, Space, Table, Tag } from 'antd';
 import { CheckOutlined, CloseOutlined, SendOutlined } from '@ant-design/icons';
 import type { ColumnsType } from 'antd/es/table';
 import {
@@ -8,6 +8,7 @@ import {
   delegateTask,
   type TaskInfo,
 } from '../../api/workflowTasks';
+import { useThemeMode } from '../../hooks/useThemeMode';
 
 export default function PendingTasks() {
   const [data, setData] = useState<TaskInfo[]>([]);
@@ -18,8 +19,7 @@ export default function PendingTasks() {
   const [outcome, setOutcome] = useState('approved');
   const [delegateModal, setDelegateModal] = useState<TaskInfo | null>(null);
   const [delegateTo, setDelegateTo] = useState('');
-  const { token } = theme.useToken();
-  const isDark = token.colorBgContainer === '#111827' || token.colorBgContainer === 'rgb(17, 24, 39)';
+  const isDark = useThemeMode();
 
   const fetchData = useCallback(async () => {
     setLoading(true);

apps/web/src/pages/workflow/ProcessDefinitions.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useState, useCallback } from 'react';
-import { Button, message, Modal, Space, Table, Tag, theme } from 'antd';
+import { Button, message, Modal, Space, Table, Tag } from 'antd';
 import { PlusOutlined } from '@ant-design/icons';
 import type { ColumnsType } from 'antd/es/table';
 import {
@@ -11,6 +11,7 @@ import {
   type CreateProcessDefinitionRequest,
 } from '../../api/workflowDefinitions';
 import ProcessDesigner from './ProcessDesigner';
+import { useThemeMode } from '../../hooks/useThemeMode';
 
 const statusColors: Record<string, { bg: string; color: string; text: string }> = {
   draft: { bg: '#f8fafc', color: '#475569', text: '草稿' },
@@ -25,8 +26,7 @@ export default function ProcessDefinitions() {
   const [loading, setLoading] = useState(false);
   const [designerOpen, setDesignerOpen] = useState(false);
   const [editingId, setEditingId] = useState<string | null>(null);
-  const { token } = theme.useToken();
-  const isDark = token.colorBgContainer === '#111827' || token.colorBgContainer === 'rgb(17, 24, 39)';
+  const isDark = useThemeMode();
 
   const fetchData = useCallback(async (p = page) => {
     setLoading(true);