docs: 全面更新 README 与站点到 v0.2.5 最终状态

README:
- badge 测试数 768→780，目录补语法高亮章节
- 特性修正：解析器 99% 行覆盖、六语言、16 个高亮语言标识
- 事件表补 selectionChange / cursorMove
- 插件表补 exportPDF / searchReplace 大小写全字 / imagePaste maxSizeKB
- XSS 章节补属性级注入防护说明
- 构建章节补 npm run bench
- 源码结构补 5 个新模块（commands/floating-toolbar/context-menu/outline/highlight）

site:
- index.html: 测试数/gzip 体积更正（42KB）、新增语法高亮特性卡、
  光标选区 API 速览卡、六语言文案
- demo.html: 启用内置高亮（highlight: MeEditor.highlight）、
  新增 python/bash 代码块演示、v0.2.5 真实新特性列表、17 源文件/780 测试
- docs.html: 高亮章节补 16 标识与 CSS 定制示例、exportPDF/maxSizeKB/
  大小写全字说明、XSS 属性注入、静态 API 补 highlight 导入

src:
- styles.ts: 新增 me-hl-* 高亮配色（深浅色自适应）
- 修复复查引入的 TS 错误（普通函数 this 返回类型非法）

site/demo.html

@@ -49,7 +49,7 @@ body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI","PingFang SC","Micr
   <div class="badges">
     <span class="badge">TypeScript</span>
     <span class="badge">零运行时依赖</span>
-    <span class="badge">768 tests</span>
+    <span class="badge">780 tests</span>
     <span class="badge">6 个插件</span>
     <span class="badge">桌面端优先</span>
   </div>
@@ -80,8 +80,9 @@ body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI","PingFang SC","Micr
 </div>
 
 <div class="info-grid">
-  <div class="info-card"><div class="icon">🏗️</div><h4>TypeScript 全模块重构</h4><p>12 个 .ts 源文件，严格模式，完整类型导出</p></div>
+  <div class="info-card"><div class="icon">🏗️</div><h4>TypeScript 全模块重构</h4><p>17 个 .ts 源文件，严格模式，完整类型导出</p></div>
   <div class="info-card"><div class="icon">📝</div><h4>自研解析器 99% 行覆盖</h4><p>CommonMark + GFM：粗斜体、链接内格式、脚注、数学公式等</p></div>
+  <div class="info-card"><div class="icon">🎨</div><h4>内置语法高亮</h4><p>零依赖 tokenizer，js / ts / python / bash 等 16 个语言标识</p></div>
   <div class="info-card"><div class="icon">📂</div><h4>磁盘文件读写</h4><p>File System Access API 打开 / 保存真实 .md 文件</p></div>
   <div class="info-card"><div class="icon">🔢</div><h4>行号装订线</h4><p>当前行高亮，与编辑区滚动同步</p></div>
   <div class="info-card"><div class="icon">🧘</div><h4>Zen 专注模式</h4><p>工具栏自动隐藏，鼠标移到顶部滑入</p></div>
@@ -102,15 +103,15 @@ var demoMd=[
   '# 🚀 MetonaEditor v0.2.5 全功能演示',
   '',
   '> TypeScript 重构 · 零运行时依赖 · **桌面端** Markdown Editor 库。',
-  '> 全模块 TypeScript 严格模式，12 个源文件，768 个测试全部通过。',
+  '> 全模块 TypeScript 严格模式，17 个源文件，780 个测试全部通过。',
   '',
   '## ✨ v0.2.5 新特性',
   '',
-  '- 浮动格式工具栏：选中文本自动弹出 bold/italic/code/link',
-  '- 新增 `getSelectedText()` `getCursorPosition()` 等 10+ API',
-  '- `replaceAll` / `replaceAllRegex` 批量替换',
-  '- `selectionChange` / `cursorMove` 事件',
-  '- 德语（de）翻译 · 6 种语言支持',
+  '- 内置**零依赖语法高亮**：js / ts / python / bash 等 16 个语言标识',
+  '- `exportPDF()` 打印导出 · `imagePaste` 尺寸限制（maxSizeKB）',
+  '- 搜索面板支持**大小写 / 全字匹配**开关（Aa / ab）',
+  '- `maxLength` 限制文档大小 · `zenMode: true` 启动即专注',
+  '- 安全加固：属性级注入防护 · 发布产物 .mjs / .cjs 规范',
   '',
   '## 📐 文本样式',
   '',
@@ -139,7 +140,7 @@ var demoMd=[
   '',
   '| 版本 | 日期 | 测试 | 主题 |',
   '| :--- | :---: | ---: | --- |',
-  '| v0.2.5 | 2026-08 | 768 | 浮动工具栏+新API |',
+  '| v0.2.5 | 2026-08 | 780 | 内置高亮+安全修复 |',
   '| v0.2.2 | 2026-07 | 694 | 法语+表格格式化 |',
   '| v0.2.1 | 2026-07 | 684 | 引用链接+右键菜单 |',
   '| v0.2.0 | 2026-07 | 610 | TypeScript 重构 |',
@@ -185,6 +186,23 @@ var demoMd=[
   'editor.exec("bold").exec("h1").focus();',
   '```',
   '',
+  '```python',
+  'def fib(n):',
+  '    """返回斐波那契数列第 n 项"""',
+  '    a, b = 0, 1',
+  '    for _ in range(n):',
+  '        a, b = b, a + b',
+  '    return a',
+  '',
+  'print(fib(10))  # 55',
+  '```',
+  '',
+  '```bash',
+  '# 安装与启动',
+  'npm install @metona-team/metona-editor',
+  'npm run dev',
+  '```',
+  '',
   '## 📌 脚注',
   '',
   '这是一个带脚注的句子[^1]，另一个脚注[^note]。',
@@ -204,6 +222,7 @@ var editor = MeEditor.create('#editor',{
   mode: 'split', height: 620,
   lineNumbers: true, autoBrackets: true, wordCount: true,
   theme: 'auto', locale: 'zh-CN', outline: false,
+  highlight: MeEditor.highlight,
   plugins: ['autoSave','exportTool','searchReplace','imagePaste','shortcutHelp','fileSystem'],
   onLinkClick: function(uri, text, ed){
     ed.toast('链接: ' + uri, { type: 'info', duration: 2000 });

site/docs.html

@@ -335,12 +335,15 @@ MeEditor<span class="c-punc">.</span><span class="c-fn">setTheme</span><span cla
 MeEditor<span class="c-punc">.</span><span class="c-fn">setLocale</span><span class="c-punc">(</span><span class="c-str">'en-US'</span><span class="c-punc">);</span>
 
 <span class="c-com">// 解析器独立使用</span>
-<span class="c-kw">import</span> <span class="c-punc">{</span> parseMarkdown<span class="c-punc">,</span> parseTokens<span class="c-punc">,</span> renderTokens <span class="c-punc">}</span> <span class="c-kw">from</span> <span class="c-str">'@metona-team/metona-editor'</span><span class="c-punc">;</span></pre>
+<span class="c-kw">import</span> <span class="c-punc">{</span> parseMarkdown<span class="c-punc">,</span> parseTokens<span class="c-punc">,</span> renderTokens <span class="c-punc">}</span> <span class="c-kw">from</span> <span class="c-str">'@metona-team/metona-editor'</span><span class="c-punc">;</span>
+
+<span class="c-com">// 内置语法高亮</span>
+<span class="c-kw">import</span> <span class="c-punc">{</span> highlight<span class="c-punc">,</span> registerLanguage <span class="c-punc">}</span> <span class="c-kw">from</span> <span class="c-str">'@metona-team/metona-editor'</span><span class="c-punc">;</span></pre>
 </section>
 
 <!-- 语法高亮 -->
 <section id="highlight"><h2>内置语法高亮</h2>
-<p>v0.2.5 起内置零依赖轻量高亮器，支持 js / ts / tsx / jsx / python / bash / css / html / json / yaml / markdown / java / go / rust。</p>
+<p>v0.2.5 起内置零依赖轻量高亮器，支持 js / ts / tsx / jsx / python / bash / css / html / json / yaml / markdown / java / go / rust（含 shell / md 别名共 16 个语言标识）。</p>
 <pre><span class="c-kw">import</span> MeEditor <span class="c-kw">from</span> <span class="c-str">'@metona-team/metona-editor'</span><span class="c-punc">;</span>
 
 <span class="c-com">// 方式一：作为 highlight 钩子（代码块自动高亮）</span>
@@ -351,7 +354,10 @@ MeEditor<span class="c-punc">.</span><span class="c-fn">create</span><span class
 
 <span class="c-com">// 注册自定义语言</span>
 MeEditor<span class="c-punc">.</span><span class="c-fn">registerLanguage</span><span class="c-punc">(</span><span class="c-str">'myLang'</span><span class="c-punc">,</span> <span class="c-punc">{</span> keywords<span class="c-punc">:</span> <span class="c-punc">[</span><span class="c-str">'kw'</span><span class="c-punc">]</span><span class="c-punc">,</span> builtins<span class="c-punc">:</span> <span class="c-punc">[]</span> <span class="c-punc">});</span></pre>
-<p>高亮输出使用 <code>me-hl-keyword</code> / <code>me-hl-string</code> / <code>me-hl-comment</code> / <code>me-hl-number</code> / <code>me-hl-builtin</code> / <code>me-hl-function</code> 类，可用 CSS 变量或选择器定制颜色。</p>
+<p>高亮输出使用 <code>me-hl-keyword</code> / <code>me-hl-string</code> / <code>me-hl-comment</code> / <code>me-hl-number</code> / <code>me-hl-builtin</code> / <code>me-hl-function</code> 类。内置浅色 / 深色自适应配色，可通过 CSS 覆盖定制：</p>
+<pre><span class="c-com">/* 自定义配色（覆盖内置默认） */</span>
+<span class="c-kw">.me-preview</span> <span class="c-punc">.</span><span class="c-kw">me-hl-keyword</span><span class="c-punc">{</span> color<span class="c-punc">:</span> <span class="c-str">#a855f7</span> <span class="c-punc">}</span>
+<span class="c-kw">.me-preview</span> <span class="c-punc">.</span><span class="c-kw">me-hl-string</span><span class="c-punc">{</span> color<span class="c-punc">:</span> <span class="c-str">#22c55e</span> <span class="c-punc">}</span></pre>
 </section>
 
 <!-- 解析器语法 -->
@@ -387,7 +393,7 @@ MeEditor<span class="c-punc">.</span><span class="c-fn">registerLanguage</span><
 <tr><td>反斜杠转义 <span class="badge">v0.1.15</span></td><td><code>\*</code> <code>\_</code></td><td>取消标点特殊含义</td></tr>
 </table>
 <h4>XSS 防护</h4>
-<p>所有文本经 <code>escapeHTML</code> 转义，URL 过滤 <code>javascript:</code> / <code>vbscript:</code> / <code>file:</code> / 非图片 <code>data:</code>，提供 <code>sanitize</code> 钩子。</p>
+<p>所有文本经 <code>escapeHTML</code> 转义，URL 过滤 <code>javascript:</code> / <code>vbscript:</code> / <code>file:</code> / 非图片 <code>data:</code>，属性级注入防护（<code>href</code> / <code>src</code> / <code>alt</code> / <code>title</code> 引号转义），提供 <code>sanitize</code> 钩子。</p>
 </section>
 
 <section id="parser-api"><h2>解析器 API</h2>
@@ -422,12 +428,12 @@ tokens<span class="c-punc">.</span><span class="c-fn">unshift</span><span class=
 editor<span class="c-punc">.</span><span class="c-fn">restoreDraft</span><span class="c-punc">();</span>  editor<span class="c-punc">.</span><span class="c-fn">clearDraft</span><span class="c-punc">();</span></pre>
 <h4>exportTool</h4>
 <pre>editor<span class="c-punc">.</span><span class="c-fn">use</span><span class="c-punc">(</span><span class="c-str">'exportTool'</span><span class="c-punc">);</span>
-editor<span class="c-punc">.</span><span class="c-fn">exportMarkdown</span><span class="c-punc">(</span><span class="c-str">'doc.md'</span><span class="c-punc">);</span>  editor<span class="c-punc">.</span><span class="c-fn">exportHTML</span><span class="c-punc">(</span><span class="c-str">'doc.html'</span><span class="c-punc">);</span></pre>
+editor<span class="c-punc">.</span><span class="c-fn">exportMarkdown</span><span class="c-punc">(</span><span class="c-str">'doc.md'</span><span class="c-punc">);</span>  editor<span class="c-punc">.</span><span class="c-fn">exportHTML</span><span class="c-punc">(</span><span class="c-str">'doc.html'</span><span class="c-punc">);</span>  editor<span class="c-punc">.</span><span class="c-fn">exportPDF</span><span class="c-punc">();</span></pre>
 <h4>searchReplace</h4>
 <pre>editor<span class="c-punc">.</span><span class="c-fn">use</span><span class="c-punc">(</span><span class="c-str">'searchReplace'</span><span class="c-punc">);</span>
-<span class="c-com">// Ctrl+F 查找 / Ctrl+H 替换</span></pre>
+<span class="c-com">// Ctrl+F 查找 / Ctrl+H 替换，支持正则 .* 、大小写 Aa、全字 ab 开关</span></pre>
 <h4>imagePaste</h4>
-<pre>editor<span class="c-punc">.</span><span class="c-fn">use</span><span class="c-punc">(</span><span class="c-str">'imagePaste'</span><span class="c-punc">);</span>  <span class="c-com">// 粘贴图片自动转 base64</span></pre>
+<pre>editor<span class="c-punc">.</span><span class="c-fn">use</span><span class="c-punc">(</span><span class="c-str">'imagePaste'</span><span class="c-punc">,</span> <span class="c-punc">{</span> maxSizeKB<span class="c-punc">:</span> <span class="c-num">500</span> <span class="c-punc">});</span>  <span class="c-com">// 粘贴图片转 base64，超限警告</span></pre>
 <h4>shortcutHelp</h4>
 <pre>editor<span class="c-punc">.</span><span class="c-fn">use</span><span class="c-punc">(</span><span class="c-str">'shortcutHelp'</span><span class="c-punc">);</span>  <span class="c-com">// 按 ? 弹出快捷键面板</span></pre>
 <h4>fileSystem</h4>

site/index.html

@@ -109,7 +109,7 @@ footer a:hover{text-decoration:underline}
     <span class="badge accent">v0.2.5</span>
     <span class="badge">TypeScript</span>
     <span class="badge">零运行时依赖</span>
-    <span class="badge">768 tests</span>
+    <span class="badge">780 tests</span>
     <span class="badge">桌面端优先</span>
     <span class="badge">MIT</span>
   </div>
@@ -120,8 +120,8 @@ footer a:hover{text-decoration:underline}
   <div class="stats">
     <div class="stat"><div class="stat-num">0</div><div class="stat-label">运行时依赖</div></div>
     <div class="stat"><div class="stat-num">99%</div><div class="stat-label">解析器行覆盖</div></div>
-    <div class="stat"><div class="stat-num">768</div><div class="stat-label">单元测试</div></div>
-    <div class="stat"><div class="stat-num">~30KB</div><div class="stat-label">gzip 体积</div></div>
+    <div class="stat"><div class="stat-num">780</div><div class="stat-label">单元测试</div></div>
+    <div class="stat"><div class="stat-num">~42KB</div><div class="stat-label">gzip 体积</div></div>
   </div>
 </header>
 
@@ -144,8 +144,9 @@ footer a:hover{text-decoration:underline}
       <div class="feature"><div class="feature-icon"><svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="18" height="18" rx="2"/><line x1="12" y1="3" x2="12" y2="21"/></svg></div><h3>分屏实时预览</h3><p>edit / split / preview 三模式切换，拖拽分隔条调整比例，双向比例同步滚动。</p></div>
       <div class="feature"><div class="feature-icon"><svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><path d="M2 17l10 5 10-5"/><path d="M2 12l10 5 10-5"/></svg></div><h3>零运行时依赖</h3><p>不依赖任何第三方运行时库，打包后单文件，UMD / ESM / CJS 三种格式开箱即用。</p></div>
       <div class="feature"><div class="feature-icon"><svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="3"/><path d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 0 1 0 2.83 2 2 0 0 1-2.83 0l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-4 0v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 0 1-2.83 0 2 2 0 0 1 0-2.83l.06-.06a1.65 1.65 0 0 0 .33-1.82 1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1 0-4h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 0 1 0-2.83 2 2 0 0 1 2.83 0l.06.06a1.65 1.65 0 0 0 1.82.33H9a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 4 0v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 0 1 2.83 0 2 2 0 0 1 0 2.83l-.06.06a1.65 1.65 0 0 0-.33 1.82V9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 0 4h-.09a1.65 1.65 0 0 0-1.51 1z"/></svg></div><h3>6 个预设插件</h3><p>autoSave / exportTool / searchReplace / imagePaste / shortcutHelp / fileSystem，插件 v2 支持拓扑排序、异步、卸载。</p></div>
-      <div class="feature"><div class="feature-icon"><svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="5"/><line x1="12" y1="1" x2="12" y2="3"/><line x1="12" y1="21" x2="12" y2="23"/><line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/><line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/><line x1="1" y1="12" x2="3" y2="12"/><line x1="21" y1="12" x2="23" y2="12"/></svg></div><h3>主题 & i18n</h3><p>4 套预设主题 + CSS 变量定制 + 实例级隔离。中英双语开箱即用，支持远程加载翻译包。</p></div>
-      <div class="feature"><div class="feature-icon"><svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg></div><h3>XSS 安全防护</h3><p>HTML 转义、危险协议过滤、sanitize 钩子、highlight 异常回退。多层防护，安全可靠。</p></div>
+      <div class="feature"><div class="feature-icon"><svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="5"/><line x1="12" y1="1" x2="12" y2="3"/><line x1="12" y1="21" x2="12" y2="23"/><line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/><line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/><line x1="1" y1="12" x2="3" y2="12"/><line x1="21" y1="12" x2="23" y2="12"/></svg></div><h3>主题 & i18n</h3><p>4 套预设主题 + CSS 变量定制 + 实例级隔离。六种语言开箱即用（中 / 英 / 日 / 韩 / 法 / 德），支持远程加载翻译包。</p></div>
+      <div class="feature"><div class="feature-icon"><svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="16 18 22 12 16 6"/><polyline points="8 6 2 12 8 18"/></svg></div><h3>内置语法高亮</h3><p>零依赖轻量高亮器，js / ts / python / bash / css 等 16 个语言标识，代码块一行配置即自动着色。</p></div>
+      <div class="feature"><div class="feature-icon"><svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg></div><h3>XSS 安全防护</h3><p>HTML 转义、危险协议过滤、属性级注入防护、sanitize 钩子、highlight 异常回退。多层防护，安全可靠。</p></div>
     </div>
   </div>
 </section>
@@ -188,7 +189,8 @@ editor<span class="c-punc">.</span><span class="c-fn">exec</span><span class="c-
     <span class="section-eyebrow">API Reference</span>
     <h2 class="section-title">API 速览</h2>
     <div class="api-grid">
-      <div class="api-card"><h4>内容操作</h4><ul><li>getValue() <span class="ret">string</span></li><li>setValue(md) <span class="ret">this</span></li><li>getHTML() <span class="ret">string</span></li><li>insert(text) <span class="ret">this</span></li><li>wrap(before, after) <span class="ret">this</span></li><li>focus() / blur() <span class="ret">this</span></li></ul></div>
+      <div class="api-card"><h4>内容操作</h4><ul><li>getValue() <span class="ret">string</span></li><li>setValue(md) <span class="ret">this</span></li><li>getHTML() <span class="ret">string</span></li><li>insert(text) <span class="ret">this</span></li><li>wrap(before, after) <span class="ret">this</span></li><li>replaceAll(search, rep) <span class="ret">number</span></li></ul></div>
+      <div class="api-card"><h4>光标与选区</h4><ul><li>getSelectedText() <span class="ret">string</span></li><li>getCursorPosition() <span class="ret">{line,column}</span></li><li>setCursorPosition(l, c) <span class="ret">this</span></li><li>selectLine(n) / selectAll() <span class="ret">this</span></li><li>toggleFloatingToolbar() <span class="ret">this</span></li></ul></div>
       <div class="api-card"><h4>命令执行</h4><ul><li>exec(action) <span class="ret">this</span></li><li>undo() / redo() <span class="ret">this</span></li><li>canUndo() / canRedo() <span class="ret">boolean</span></li></ul></div>
       <div class="api-card"><h4>模式与全屏</h4><ul><li>setMode(mode) <span class="ret">this</span></li><li>getMode() <span class="ret">string</span></li><li>toggleFullscreen() <span class="ret">this</span></li><li>toggleZen() <span class="ret">this</span></li></ul></div>
       <div class="api-card"><h4>事件与插件</h4><ul><li>on(event, fn) <span class="ret">unsub</span></li><li>off(event, fn) <span class="ret">this</span></li><li>use(plugin) <span class="ret">this</span></li><li>unuse(name) <span class="ret">this</span></li><li>addToolbarButton(cfg) <span class="ret">this</span></li></ul></div>