[Sycun]

Problem

Both plugins still send only password to /api/auth/login. Since RBAC requires a username, even a correct web-login password fails with HTTP 400: 用户名不能为空，且不能超过 64 个字符.

Changes

• Add an editable Username field, defaulting to admin, to both plugins and submit username with password. Custom RBAC accounts use their own username.
• Trim and validate usernames while preserving passwords exactly. Persist the browser username without storing passwords.
• Clear cached authentication when connection settings or credentials change. Lock credential fields during validation and keep cancellation pending until the login attempt finishes.
• Update Chinese/English setup instructions, bump the browser extension to 0.3.11, and refresh the distributed browser ZIP and Burp JAR. Existing installations must reload the updated extension/JAR.
• Add local HTTP regression fixtures and a focused GitHub Actions workflow.

Validation

• BURP_API_JAR=/tmp/csai-burp-extender-api.jar bash scripts/test-plugin-auth.sh passed: both login clients, admin/custom accounts, JSON escaping and exact password preservation, empty/overlong usernames, failed login, browser settings migration and no password persistence, and Burp account-switch token invalidation.
• Burp compiled and packaged with Java 11 target (build.sh).
• Browser JavaScript syntax check passed; packaged ZIP contents matched the updated source and manifest.
• git diff --check passed.

Validation uses local HTTP fixtures and headless Swing components; a live Burp/Chromium session against a running CyberStrikeAI server has not been exercised.