phsl / new-api

- Pin all GitHub Actions to commit SHA to prevent supply chain attacks
- Enable SLSA provenance attestation (mode=max) and SBOM generation
- Add cosign keyless signing for Docker images via GitHub OIDC
- Capture and output image digests to GitHub Job Summary
- Pin Dockerfile base images to digest (bun:1, golang:1.26.1-alpine, debian:bookworm-slim)
- Add SHA256 checksum generation for binary releases (Linux/macOS/Windows)
- Update actions/checkout v3->v4, actions/setup-go v3->v5 in release.yml

fix: the "detail" field is empty, an empty field was sent to upstream

refactor: optimize billing flow for OpenAI-to-Anthropic convert

Refactor/codex usage

fix: apply forced beta query at final upstream URL stage

fix: honor channel affinity skip-retry when channel is disabled

adjuct default settings

feat: support regex-prefixed ignored upstream models

fix: oauth bind callback handling

fix: disable doubao coding plan selection

docs: 完善宝塔面板部署教程并修复链接错误

feat: Add support for counting cache-hit tokens in llama.cpp

feat: add server log file management to performance settings

- Fix data race on gin.DefaultWriter during log rotation by adding LogWriterMu
- Report partial failure when some log files fail to delete instead of always returning success
- Fix misleading "logging disabled" banner shown before API responds
- Fix en.json translation for numeric validation message

Add API endpoints (GET/DELETE /api/performance/logs) to list and clean up
server log files by count or by age. Track the active log file path in
the logger to prevent deleting the currently open log. Add a management
UI section in the performance settings page with log directory info,
file statistics, and cleanup controls. Includes i18n translations for
all supported languages (en, fr, ja, ru, vi, zh-CN, zh-TW).

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

- 完善 docs/installation/BT.md，从 2 行扩展为完整教程
- 包含前置要求、安装步骤、配置说明、常见问题
- 修复 README.zh_CN.md 中的链接错误
- 所有内容基于官方文档 https://docs.newapi.pro 编写

fix: normalize generic oauth bearer token type

fix: redirect OAuth login in current page