feat: 加致谢面板 + README 贡献者段

Dashboard 侧栏新增"关于 → 致谢"面板，列出外部贡献者：
- dd373156 — PR #1 修 Pro 层模型合并
- colin1112a — PR #13 一次性审 15 个 bug

卡片含 GitHub 头像（github.com/:user.png）、PR 链接、合并日期、改动说明。CONTRIBUTORS 数组手动维护，后续有 PR 直接加一项就能渲染。底部放"提 issue / 提 PR"按钮鼓励继续贡献。

README.md / README.en.md 也加了对应的 Contributors 段放在 MIT 前。

Author: dwgx

README.en.md

@@ -303,6 +303,17 @@ A: Yes. `export ANTHROPIC_BASE_URL=http://YOUR_API` + `export ANTHROPIC_API_KEY=
 **Q: What models can free accounts use?**
 A: Only `gpt-4o-mini` and `gemini-2.5-flash`. All others require Pro.
 
+## Contributors
+
+Huge thanks to the following folks who sent pull requests or systematically audited the code:
+
+- [@dd373156](https://github.com/dd373156) — [PR #1](https://github.com/dwgx/WindsurfAPI/pull/1)
+  Fixed the Pro tier model-merge logic: the hardcoded table wasn't picking up dynamically-fetched cloud models, so Pro accounts couldn't see newly-released models in Cursor / Cherry Studio.
+- [@colin1112a](https://github.com/colin1112a) — [PR #13](https://github.com/dwgx/WindsurfAPI/pull/13)
+  A single-shot audit that flagged 15 security / concurrency / resource bugs: XSS escaping, shell injection, OOM guards, auth route placement, gRPC double-callback, LS pool race, HTTP/2 frame size caps, and more. On top of this we later added a JS-level `escJsAttr`, coalesced concurrent `ensureLs` calls via `_pending`, released pooled sessions on LS exit, and fixed 6 more issues surfaced by a follow-up Antigravity audit.
+
+Want to be on this list? Open an [issue](https://github.com/dwgx/WindsurfAPI/issues) or a [pull request](https://github.com/dwgx/WindsurfAPI/pulls). The dashboard has a Credits panel on the left that shows the same info.
+
 ## License
 
 MIT

README.md

@@ -307,6 +307,17 @@ A: 能。`export ANTHROPIC_BASE_URL=http://你的API` + `export ANTHROPIC_API_KE
 **Q: 免费账号能用什么模型**
 A: 只有 `gpt-4o-mini` 和 `gemini-2.5-flash`，其他全要 Pro。
 
+## 贡献者
+
+特别感谢下面的朋友，他们提交过 PR 或系统性地审了代码，让这个项目变得更稳：
+
+- [@dd373156](https://github.com/dd373156) — [PR #1](https://github.com/dwgx/WindsurfAPI/pull/1)
+  修复 Pro 层级的模型合并逻辑：原本只看硬编码清单，云端动态拉回来的模型没进 tier 表，Pro 账号在 Cursor / Cherry Studio 里看不到新上线的模型。
+- [@colin1112a](https://github.com/colin1112a) — [PR #13](https://github.com/dwgx/WindsurfAPI/pull/13)
+  一次性审了 15 个安全 / 并发 / 资源管理 bug：XSS 转义、shell 注入、OOM 防护、auth 路由位置、gRPC 双回调、LS pool 竞态、HTTP/2 帧大小上限等。后续我们在这个基础上又加固了 JS-level `escJsAttr`、`_pending` 合并并发 `ensureLs`、LS 退出时释放 pooled session，并延伸修了 Antigravity 审计发现的 6 个问题。
+
+想加入这份名单？欢迎提 [issue](https://github.com/dwgx/WindsurfAPI/issues) 或 [pull request](https://github.com/dwgx/WindsurfAPI/pulls)。Dashboard 左侧有"致谢"面板 能看到同样的信息。
+
 ## 授权
 
 MIT

src/dashboard/index.html

@@ -863,6 +863,19 @@
   .sidebar nav a { justify-content: center; padding: 10px; }
   .main { margin-left: 60px; padding: 20px 16px; }
 }
+.contributor-list { display: flex; flex-direction: column; gap: 12px; }
+.contributor-card { display: flex; gap: 16px; padding: 16px; border: 1px solid var(--border); border-radius: var(--radius); background: var(--surface); transition: border-color .15s; }
+.contributor-card:hover { border-color: var(--accent); }
+.contributor-card .avatar { width: 64px; height: 64px; border-radius: 50%; flex: none; border: 2px solid var(--border); background: var(--surface-2); object-fit: cover; }
+.contributor-card .meta { display: flex; flex-direction: column; gap: 4px; flex: 1; min-width: 0; }
+.contributor-card .meta-top { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; }
+.contributor-card .meta-top .name { color: var(--accent); font-weight: 600; font-size: 15px; text-decoration: none; }
+.contributor-card .meta-top .name:hover { text-decoration: underline; }
+.contributor-card .meta-top .pr-link { font-size: 12px; color: var(--text-dim); text-decoration: none; padding: 2px 8px; border: 1px solid var(--border); border-radius: 4px; }
+.contributor-card .meta-top .pr-link:hover { color: var(--accent); border-color: var(--accent); }
+.contributor-card .meta-top .merged-at { font-size: 11px; color: var(--text-dim); }
+.contributor-card .pr-title { font-weight: 500; margin-top: 4px; font-size: 13px; }
+.contributor-card .summary { font-size: 13px; color: var(--text-muted); line-height: 1.65; margin-top: 6px; }
 </style>
 <script type="module">
 import { initializeApp } from 'https://www.gstatic.com/firebasejs/11.6.0/firebase-app.js';
@@ -944,6 +957,13 @@
         <span data-i18n="nav.experimental">实验性功能</span>
       </a>
     </div>
+    <div class="nav-group">
+      <div class="nav-group-label" data-i18n="nav.group.about">关于</div>
+      <a href="#credits" data-panel="credits">
+        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"><path d="M20.84 4.61a5.5 5.5 0 0 0-7.78 0L12 5.67l-1.06-1.06a5.5 5.5 0 0 0-7.78 7.78l1.06 1.06L12 21.23l7.78-7.78 1.06-1.06a5.5 5.5 0 0 0 0-7.78z"/></svg>
+        <span data-i18n="nav.credits">致谢</span>
+      </a>
+    </div>
   </nav>
   <div class="footer">
     <button class="btn btn-ghost btn-xs" onclick="App.toggleLang()" title="Switch language" style="margin-right:8px">
@@ -1443,6 +1463,41 @@ <h1 class="page-title" data-i18n="page.bans">异常监测</h1>
     </div>
   </section>
 
+  <section class="panel" id="p-credits">
+    <div class="page-header">
+      <div>
+        <h1 class="page-title" data-i18n="page.credits">致谢</h1>
+        <div class="page-subtitle" data-i18n="page.credits.sub">感谢以下朋友为项目提交 PR / 审计代码 / 修复问题</div>
+      </div>
+    </div>
+    <div class="section">
+      <div class="section-header">
+        <div class="section-title" data-i18n="credits.contributors">核心贡献者</div>
+      </div>
+      <div class="section-body" id="credits-body">
+        <div class="text-sm text-dim">加载中…</div>
+      </div>
+    </div>
+    <div class="section">
+      <div class="section-header">
+        <div class="section-title" data-i18n="credits.cta">想加入这份名单？</div>
+      </div>
+      <div class="section-body">
+        <div class="section-desc" data-i18n="credits.cta.desc">欢迎到 GitHub 提 issue 或 pull request — 不管是修 bug、加模型、改 UI 还是发现安全问题，都会被记录在这里。</div>
+        <div style="margin-top:12px">
+          <a class="btn btn-outline btn-sm" target="_blank" rel="noopener" href="https://github.com/dwgx/WindsurfAPI/issues">
+            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" style="width:14px;height:14px;margin-right:6px"><circle cx="12" cy="12" r="10"/><line x1="12" y1="8" x2="12" y2="12"/><line x1="12" y1="16" x2="12.01" y2="16"/></svg>
+            <span data-i18n="credits.cta.issue">提 issue</span>
+          </a>
+          <a class="btn btn-outline btn-sm" target="_blank" rel="noopener" href="https://github.com/dwgx/WindsurfAPI/pulls" style="margin-left:8px">
+            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" style="width:14px;height:14px;margin-right:6px"><circle cx="18" cy="18" r="3"/><circle cx="6" cy="6" r="3"/><path d="M13 6h3a2 2 0 0 1 2 2v7"/><line x1="6" y1="9" x2="6" y2="21"/></svg>
+            <span data-i18n="credits.cta.pr">提 PR</span>
+          </a>
+        </div>
+      </div>
+    </div>
+  </section>
+
   <section class="panel" id="p-experimental">
     <div class="page-header">
       <div>
@@ -1539,6 +1594,8 @@ <h3>控制台登录</h3>
   'nav.proxy': 'Proxy',
   'nav.logs': 'Logs',
   'nav.experimental': 'Experimental',
+  'nav.group.about': 'About',
+  'nav.credits': 'Credits',
   'page.overview': 'Dashboard',
   'page.stats': 'Statistics',
   'page.windsurf-login': 'Account Login',
@@ -1548,6 +1605,13 @@ <h3>控制台登录</h3>
   'page.proxy': 'Proxy Config',
   'page.logs': 'Runtime Logs',
   'page.experimental': 'Experimental Features',
+  'page.credits': 'Credits',
+  'page.credits.sub': 'Thanks to contributors who submitted PRs / audited code / reported issues',
+  'credits.contributors': 'Core Contributors',
+  'credits.cta': 'Want to join this list?',
+  'credits.cta.desc': 'Open an issue or pull request on GitHub — bug fixes, new models, UI improvements, or security findings all get recognised here.',
+  'credits.cta.issue': 'Open Issue',
+  'credits.cta.pr': 'Open PR',
 };
 
 const App = {
@@ -1634,6 +1698,7 @@ <h3>控制台登录</h3>
       accounts: 'loadAccounts', models: 'loadModels', proxy: 'loadProxy',
       logs: 'loadLogs', stats: 'loadStats', bans: 'loadBans',
       experimental: 'loadExperimental',
+      credits: 'loadCredits',
     };
     if (loaders[panel]) this[loaders[panel]]();
   },
@@ -3048,6 +3113,41 @@ <h3>控制台登录</h3>
       fallback();
     }
   },
+  // Hand-maintained roster of external contributors. Update here when a
+  // new PR lands; the dashboard Credits panel renders straight from this.
+  CONTRIBUTORS: [
+    {
+      login: 'dd373156',
+      pr: 1,
+      mergedAt: '2026-04-20',
+      title: 'fix(models): make pro tier include dynamically merged cloud models',
+      summary: '发现 Pro 层级只看到硬编码的模型清单，拉自云端的动态扩展模型没合并进 tier 表，导致 Cursor / Cherry Studio 等客户端在 Pro 账号下也看不见最新上线的模型。修了 mergeCloudModels 的合并路径，让云端扩展模型进入 Pro 的可用清单。',
+    },
+    {
+      login: 'colin1112a',
+      pr: 13,
+      mergedAt: '2026-04-21',
+      title: 'fix: 一次性审计并提交 15 个安全 / 并发 / 资源管理 bug',
+      summary: '系统性扫了一遍仓库，围绕 XSS 转义、shell 注入、OOM 防护、auth 路由位置、gRPC 双回调、LS pool 竞态、HTTP/2 frame 上限等方向提 PR。我们在这个基础上再加固了 JS-level escJsAttr、_pending 合并 ensureLs、LS 退出时释放 pooled session，以及一些后续 Antigravity 审计发现的延伸修复。感谢提醒项目该重视 issues 了。',
+    },
+  ],
+  loadCredits() {
+    const body = document.getElementById('credits-body');
+    if (!body) return;
+    body.innerHTML = `<div class="contributor-list">${this.CONTRIBUTORS.map(c => `
+      <div class="contributor-card">
+        <img class="avatar" src="https://github.com/${this.esc(c.login)}.png?size=128" alt="${this.esc(c.login)}" loading="lazy" onerror="this.style.visibility='hidden'">
+        <div class="meta">
+          <div class="meta-top">
+            <a class="name" target="_blank" rel="noopener" href="https://github.com/${this.esc(c.login)}">@${this.esc(c.login)}</a>
+            <a class="pr-link" target="_blank" rel="noopener" href="https://github.com/dwgx/WindsurfAPI/pull/${c.pr}">PR #${c.pr}</a>
+            <span class="merged-at">${this.esc(c.mergedAt)}</span>
+          </div>
+          <div class="pr-title">${this.esc(c.title)}</div>
+          <div class="summary">${this.esc(c.summary)}</div>
+        </div>
+      </div>`).join('')}</div>`;
+  },
   esc(s) { return String(s == null ? '' : s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;'); },
   // For values interpolated into an inline `onclick="App.f('${...}')"`
   // string: the HTML attribute parser will decode &#39; back to ', which