feat(iit): Complete Day 3 - WeChat Work integration and URL verification

Summary:
- Implement WechatService (314 lines, push notifications)
- Implement WechatCallbackController (501 lines, async reply mode)
- Complete iit_quality_check Worker with WeChat notifications
- Configure WeChat routes (GET + POST /wechat/callback)
- Configure natapp tunnel for local development
- WeChat URL verification test passed

Technical Highlights:
- Async reply mode to avoid 5-second timeout
- Message encryption/decryption using @wecom/crypto
- Signature verification using getSignature
- natapp tunnel: https://iit.nat100.top
- Environment variables configuration completed

Technical Challenges Solved:
- Fix environment variable naming (WECHAT_CORP_SECRET)
- Fix @wecom/crypto import (createRequire for CommonJS)
- Fix decrypt function parameters (2 params, not 4)
- Fix Token character recognition (lowercase l vs digit 1)
- Regenerate EncodingAESKey (43 chars, correct format)
- Configure natapp for internal network penetration

Test Results:
- WeChat developer tool verification: PASSED
- Return status: request success
- HTTP 200, decrypted 23 characters correctly
- Backend logs: URL verification successful

Documentation:
- Add Day3 WeChat integration development record
- Update MVP development task list (Day 2-3 completed)
- Update module status guide (v1.2 -> v1.3)
- Overall completion: 35% -> 50%

Progress:
- Module completion: 35% -> 50%
- Day 3 development: COMPLETED
- Ready for end-to-end testing (REDCap -> WeChat)

backend/package-lock.json

@@ -14,6 +14,7 @@
         "@fastify/multipart": "^9.2.1",
         "@prisma/client": "^6.17.0",
         "@types/form-data": "^2.2.1",
+        "@wecom/crypto": "^1.0.1",
         "ajv": "^8.17.1",
         "axios": "^1.12.2",
         "bullmq": "^5.65.0",
@@ -32,12 +33,14 @@
         "tiktoken": "^1.0.22",
         "winston": "^3.18.3",
         "xlsx": "^0.18.5",
+        "xml2js": "^0.6.2",
         "zod": "^4.1.12"
       },
       "devDependencies": {
         "@types/js-yaml": "^4.0.9",
         "@types/node": "^24.7.1",
         "@types/winston": "^2.4.4",
+        "@types/xml2js": "^0.4.14",
         "better-sqlite3": "^12.4.6",
         "nodemon": "^3.1.10",
         "pino-pretty": "^13.1.1",
@@ -1076,6 +1079,22 @@
         "winston": "*"
       }
     },
+    "node_modules/@types/xml2js": {
+      "version": "0.4.14",
+      "resolved": "https://registry.npmmirror.com/@types/xml2js/-/xml2js-0.4.14.tgz",
+      "integrity": "sha512-4YnrRemBShWRO2QjvUin8ESA41rH+9nQGLUGZV/1IDhi3SL9OhdpNC/MrulTWuptXKwhx/aDxE7toV0f/ypIXQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@wecom/crypto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmmirror.com/@wecom/crypto/-/crypto-1.0.1.tgz",
+      "integrity": "sha512-K4Ilkl1l64ceJDbj/kflx8ND/J88pcl8tKx4Ivp7IiCrshRJU+Uo5uWCjAa+PjUiLIdcQSZ4m4d0t1npMPCX5A==",
+      "license": "MIT"
+    },
     "node_modules/abstract-logging": {
       "version": "2.0.1",
       "resolved": "https://registry.npmmirror.com/abstract-logging/-/abstract-logging-2.0.1.tgz",
@@ -4304,6 +4323,12 @@
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
       "license": "MIT"
     },
+    "node_modules/sax": {
+      "version": "1.4.3",
+      "resolved": "https://registry.npmmirror.com/sax/-/sax-1.4.3.tgz",
+      "integrity": "sha512-yqYn1JhPczigF94DMS+shiDMjDowYO6y9+wB/4WgO0Y19jWYk0lQ4tuG5KI7kj4FTp1wxPj5IFfcrz/s1c3jjQ==",
+      "license": "BlueOak-1.0.0"
+    },
     "node_modules/saxes": {
       "version": "5.0.1",
       "resolved": "https://registry.npmmirror.com/saxes/-/saxes-5.0.1.tgz",
@@ -4956,6 +4981,28 @@
         "node": ">=0.8"
       }
     },
+    "node_modules/xml2js": {
+      "version": "0.6.2",
+      "resolved": "https://registry.npmmirror.com/xml2js/-/xml2js-0.6.2.tgz",
+      "integrity": "sha512-T4rieHaC1EXcES0Kxxj4JWgaUQHDk+qwHcYOCFHfiwKz7tOVPLq7Hjq9dM1WCMhylqMEfP7hMcOIChvotiZegA==",
+      "license": "MIT",
+      "dependencies": {
+        "sax": ">=0.6.0",
+        "xmlbuilder": "~11.0.0"
+      },
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
+    "node_modules/xmlbuilder": {
+      "version": "11.0.1",
+      "resolved": "https://registry.npmmirror.com/xmlbuilder/-/xmlbuilder-11.0.1.tgz",
+      "integrity": "sha512-fDlsI/kFEx7gLvbecc0/ohLG50fugQp8ryHzMTuW9vSa1GJ0XYWKnhsUx7oie3G98+r56aTQIUB4kht42R3JvA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
     "node_modules/xmlchars": {
       "version": "2.2.0",
       "resolved": "https://registry.npmmirror.com/xmlchars/-/xmlchars-2.2.0.tgz",