fix(health+server+mp): 审计 P0 批次修复 — 积分冲突/文章草稿泄露/商城空白/模板ID配置化

P0-1: 微信模板 ID 从硬编码空字符串改为环境变量注入
  - wechat-templates.ts 读取 process.env.TARO_APP_WX_TEMPLATE_*
  - defineConstants 新增 5 个模板 ID 编译时注入

P0-2: 积分商城 Tab 空白降级
  - mall/index.tsx 在 currentPatient 为 null 时先调用 loadPatients()
  - 仍无档案才显示空状态引导，而非直接阻断

P0-3: 消除 erp-points 重复路由冲突
  - 从 erp-server 移除 erp-points 模块注册和路由 merge
  - 积分功能统一由 erp-health /health/points/* 提供
  - erp-points crate 保留但不参与编译

P0-4: 文章列表按角色过滤防止草稿泄露
  - list_articles handler: 非管理权限强制 status=published
  - get_article service: 新增 is_admin 参数控制状态过滤

crates/erp-server/src/main.rs

@@ -349,13 +349,9 @@ async fn main() -> anyhow::Result<()> {
         "AI module initialized"
     );
 
-    // Initialize points module
-    let points_module = erp_points::PointsModule;
-    tracing::info!(
-        module = points_module.name(),
-        version = points_module.version(),
-        "Points module initialized"
-    );
+    // Points module 已统一到 erp-health（/health/points/* 路由）
+    // erp-points 的 /points/* 路由为重复实现（大部分 501），已禁用
+
 
     // Initialize dialysis module
     let dialysis_module = erp_dialysis::DialysisModule;
@@ -373,7 +369,7 @@ async fn main() -> anyhow::Result<()> {
         .register(message_module)
         .register(health_module)
         .register(ai_module)
-        .register(points_module)
+        // erp-points 已禁用，积分功能统一由 erp-health 提供
         .register(dialysis_module);
     tracing::info!(
         module_count = registry.modules().len(),
@@ -564,7 +560,7 @@ async fn main() -> anyhow::Result<()> {
         .merge(erp_plugin::module::PluginModule::protected_routes())
         .merge(erp_health::HealthModule::protected_routes())
         .merge(erp_ai::AiModule::protected_routes())
-        .merge(erp_points::PointsModule::protected_routes())
+        // erp-points 已禁用，积分路由统一由 erp-health /health/points/* 提供
         .merge(erp_dialysis::DialysisModule::protected_routes())
         .merge(handlers::audit_log::audit_log_router())
         .route(

crates/erp-server/src/state.rs

@@ -123,16 +123,6 @@ impl FromRef<AppState> for erp_ai::AiState {
     }
 }
 
-/// Allow erp-points handlers to extract their required state.
-impl FromRef<AppState> for erp_points::PointsState {
-    fn from_ref(state: &AppState) -> Self {
-        Self {
-            db: state.db.clone(),
-            event_bus: state.event_bus.clone(),
-        }
-    }
-}
-
 /// Allow erp-dialysis handlers to extract their required state.
 impl FromRef<AppState> for erp_dialysis::DialysisState {
     fn from_ref(state: &AppState) -> Self {