fix(miniapp): add missing uuid and message-display utils

Commit the utility modules required by api.js, messages.js, and chat page
so WeChat DevTools can resolve require('./uuid') at runtime.

Co-authored-by: Cursor <cursoragent@cursor.com>

miniapp/README.md

@@ -17,6 +17,45 @@ This directory contains the native WeChat Mini Program client. It is intentional
 
 The H5 APIs are reused as-is. Native Mini Program login posts the `wx.login` code to `MINIAPP_LOGIN_PATH` in `utils/config.js`; the current default is `/auth/wechat-miniapp/login`. If that backend endpoint is not available yet, use the account/password login fallback during local development.
 
+## Production / 提审前（当前默认）
+
+- `utils/config.js` 默认 `LOCAL_DEV = false`，API 指向 **`https://m.tkmind.cn`**。
+- `project.config.json` 中 `urlCheck: true`；DevTools 需配置真实小程序 AppID（非 tourist）。
+- 微信公众平台需配置 request / web-view 合法域名：`m.tkmind.cn`。
+- 此配置**不会**触发 103 发版；仅小程序客户端连线上 Portal。
+- **微信一键登录**还需 Portal 侧配置 `H5_WECHAT_MINIAPP_APP_ID` / `H5_WECHAT_MINIAPP_APP_SECRET` 并实现 `/auth/wechat-miniapp/login`；未部署前可先用账号密码登录。
+
+### 开发者工具仍显示「游客模式」时
+
+1. 关闭项目，重新「导入项目」并选择 AppID `wx3e79ecd530c88da4`（不要选测试号/游客模式）
+2. 或：详情 → 基本信息 → AppID 改为你自己的小程序
+3. 确认 `project.config.json` 与 `project.private.config.json` 中 `appid` 均为 `wx3e79ecd530c88da4`
+4. 重新编译后再点「微信一键登录」
+
+## Local Debug (optional)
+
+1. Start local Portal in the repo root:
+
+```bash
+pnpm dev
+# or ensure http://127.0.0.1:8081/auth/status responds
+```
+
+2. Switch miniapp back to local Portal **without** touching production:
+
+   - In `utils/config.js`, set `LOCAL_DEV = true`, **or**
+   - Copy `utils/config.local.example.js` → `utils/config.local.js` and set `API_BASE_URL`.
+
+   `project.private.config.json` only affects DevTools compiler settings; it is **not** available to runtime `require()`.
+
+3. WeChat DevTools → 详情 → 本地设置 (local only):
+   - enable **Do not verify合法域名 / TLS**
+   - keep **tourist AppID** only if you use account/password login; real AppID is required for `wx.login`
+
+4. Restart Portal after pulling local server changes. Local Portal only bypasses CSRF for WeChat `servicewechat.com` referrers; production `m.tkmind.cn` is unchanged.
+
+5. Use an account that exists in your local `.env` database auth. Wrong credentials return `401`, not `403`.
+
 ## Isolation Rule
 
 Mini Program work should stay inside `miniapp/`. Do not modify backend, H5, Memory, MindSpace, or production release files for this MVP unless explicitly approved.