feat(highlight): preset overhaul, categories, stats, theme colours, per-host profiles

Rules & engine:
- 22 presets (was 11): split status into okstate/warnstate/badstate, add delop,
  createop, danger, secret, level, exitcode, percent, http; status words are
  case-insensitive and cover the ✓ ✔ ✅ ✗ ✘ ✖ ❌ ⚠ symbol set
- value bands: the first number in a match picks the colour
  (percent: <20% red / 20-50% yellow / 50-80% light green / >=80% green)
- optional per-rule `caseInsensitive`, `category`, `bands`; load-time
  `refreshBuiltinRules` upgrades untouched built-in patterns in place

Settings page:
- three-way master switch `highlightMode` (all / basic / off); `basic` runs only
  the five safety+status rules and `off` empties the rule set rather than
  bypassing HighlightStream (which would drop the held tail)
- category column + grouping (`highlightGroupByCategory`), per-rule hit/duration
  stats (`highlightStats`, opt-in sink, snapshot once a second), theme-following
  colours (`highlightThemeColors`, hue-bucket mapping onto the ANSI palette),
  import/export JSON envelope, live preview through the real engine
- named rule subsets bound per host (`highlightPerHost` + `highlightProfiles`
  + `SshConnection.highlightProfileId`); empty ruleIds = every rule

Tests: new tests/hl-rules.mjs (word boundaries, case flag, negative words,
bands, import/export, preview, basic mode, categories, stats, theme colours,
profiles) + profile round-trip in tests/settings-store.mjs

docs/ROADMAP.md

@@ -68,7 +68,7 @@
 - [ ] 命令库（分组 + 参数变量 `{{param}}` + 一键运行/粘贴）
 - [ ] 终端补全：历史 + 命令库 + 内置命令表（内置命令文档可从 tldr 页面生成）
 - [ ] 会话日志：手动启停、纯文本落盘、断线暂停指示
-- [x] ~~关键词高亮~~（✅ 已提前完成：highlightEngine 流式 ANSI 注入 + 11 条预设 + 设置页管理，见 M2.5）
+- [x] ~~关键词高亮~~（✅ 已提前完成：highlightEngine 流式 ANSI 注入 + 22 条预设 + 设置页管理，见 M2.5；状态类预设不分大小写、覆盖 ✓/✗ 符号，删除/新建操作单独着色，百分比/退出码/HTTP 状态码/耗时按数值分级取色，含密钥泄露提醒与危险管道，旧安装的预设规则在加载时按「未被用户改动过」升级）
 - 验收：补全 ↑↓ 选择 / Tab 接受 / Esc 关闭 / 回车直接执行，交互流畅
 
 ## M6 — 多终端协同 ✅

docs/STATE.md

@@ -59,17 +59,18 @@
 ```bash
 npm run typecheck   # tsconfig.node.json + tsconfig.web.json
 npm run build
-npm test            # = node tests/build-bundles.cjs && 下面 7 个测试（依次，全部离线可跑）
+npm test            # = node tests/build-bundles.cjs && 下面 8 个测试（依次，全部离线可跑）
 node tests/ssh-loopback.mjs
 node tests/commands-store.mjs
-node tests/settings-store.mjs        # 设置清洗器（closeAction/高亮规则修复/告警日志）
+node tests/settings-store.mjs        # 设置清洗器（closeAction/高亮规则修复/旧预设升级/告警日志）
 node tests/.hl-split-smoke.cjs
+node tests/.hl-rules.cjs             # 内置高亮预设（词边界、大小写、负向词、危险命令）
 node tests/zmodem-e2e.mjs
 node tests/ssh-session-e2e.mjs
 node tests/sysinfo-e2e.mjs
-# `node tests/build-bundles.cjs` 单独重建全部 6 个 esbuild bundle（别名只存在于该脚本）：
+# `node tests/build-bundles.cjs` 单独重建全部 7 个 esbuild bundle（别名只存在于该脚本）：
 #   .session-e2e.cjs(pty.ts) .sftp-svc.mjs(sftp.ts，ESM) .commands-store.cjs .settings-store.cjs
-#   .zmodem-e2e.cjs .hl-split-smoke.cjs —— 少 --alias:@shared=./src/shared 会编译失败
+#   .zmodem-e2e.cjs .hl-split-smoke.cjs .hl-rules.cjs —— 少 --alias:@shared=./src/shared 会编译失败
 # 真实服务器测试（需 JD 环境变量凭据，旧凭据已过期，不在 npm test 内）：
 # JD_HOST=... JD_USER=root JD_PASS=... node tests/sftp-real.mjs / tests/sftp-chmod.mjs
 # 打包：npm run dist（产物 release/）