docs: update contributors section, test count, and line counts (v0.50.21)

[nesquena-hermes]

Summary

Full update to the Contributors section of README.md, plus stale test/line counts.

Contributors added (21 new entries)

Major tier (new):

• @Jordan-SkyLF — live reasoning + tool progress + durable reload recovery (PRs fix: recover from invalid default workspace paths #366, fix: stream live reasoning and tool progress in the active thread #367)

Feature tier (new):

• @gabogabucho — Spanish locale + onboarding wizard (PRs feat(i18n): add Spanish locale for WebUI #275, feat(onboarding): add one-shot bootstrap and first-run setup wizard #285)
• @bergeouss — Real-time gateway session sync (PR feat: real-time gateway session sync (Phase 1) #274)
• @ccqqlo — Terminal approval UX + custom model discovery + mobile close button
• @betamod — Security hardening sprint (PR Security: harden auth, CSRF, SSRF, XSS, and env race conditions #171)
• @TaraTheStar — Bot name configurable + thinking blocks + login refactor
• @thadreber-web — Original CLI session bridge (PR feat: CLI session bridge - read CLI sessions from agent SQLite store #56)
• @deboste — Reverse proxy auth + mobile responsive + model routing (PRs fix(frontend): use URL origin for fetch/EventSource to support revers… #3–fix(css): mobile responsive layout and dvh viewport fix #5, earliest community PRs)

Bug fix/security tier (new):

• @Hinotoi-agent — Profile .env secret isolation (PR fix: isolate profile .env secrets on switch #351)
• @lawrencel1ng — Bandit security fixes B310/B324/B110 + QuietHTTPServer (PR Security fixes: B310, B324, B110 (bandit scan) #354)
• @lx3133584 — CSRF fix for reverse proxy non-standard ports (PR fix: CSRF check fails behind reverse proxy on non-standard ports #360)
• @DelightRun — session_search fix for WebUI sessions (PR fix: inject SessionDB into AIAgent for WebUI sessions (enables session_search) #356)
• @shaoxianbilly — Unicode filename downloads (PR Fix unicode filenames in file download headers #378)
• @huangzt — Cancel actually interrupts agent (PR fix: cancel button now interrupts agent and cleans up UI state #244)
• @kcclaw001 — Credential redaction in API responses (PR security: redact credentials from API responses and fix credential file permissions #243)
• @mbac — Phantom "Custom" provider group fix (PR fix: do not build phantom "Custom" group when active provider is set #191)
• @andrewy-wizard — Chinese localization (PR Add Chinese localization for Hermes WebUI #177)
• @mmartial — Docker UID/GID matching (PR [Docker] Add the ability to run with the same user id/gid as the hermes installing user #237)
• @vCillusion — pip package resolution fix (PR fix: resolve pip packages from site-packages instead of agent dir #76)
• @carlytwozero — API key pass-through for non-Anthropic providers (PR fix: pass api_key to AIAgent for non-Anthropic /anthropic providers #78)
• @mangodxd — Type hints cleanup (PR chore: add missing type hints (10 files) #115)

Other fixes

• Test count: 802 → 961
• Line counts updated for routes.py, streaming.py, ui.js, messages.js, sessions.js