docs: complete bilingual cross-links for switch console docs

Add English stubs for zh-only strategy-switch notes, QMT target README, and
cross-language links across pin policy and console documentation.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Pigbibi

docs/internal_dependency_pin_policy.md

@@ -1,5 +1,7 @@
 # Internal dependency pin policy
 
+[简体中文](internal_dependency_pin_policy.zh-CN.md)
+
 QuantStrategyLab shares Python packages across platforms, strategies, and pipelines via git URL pins. This document explains how pins are tracked, when to use tags versus full commit SHAs, and how to bump dependencies safely.
 
 ## Source of truth

docs/internal_dependency_pin_policy.zh-CN.md

@@ -1,5 +1,7 @@
 # 内部依赖 pin 政策
 
+[English](internal_dependency_pin_policy.md)
+
 QuantStrategyLab 通过 git URL pin 在平台、策略与 pipeline 之间共享 Python 包。本文说明 pin 如何被追踪、何时使用 tag 与完整 commit SHA，以及如何安全升级依赖。
 
 ## 权威来源

docs/manual_strategy_switch_permission_control.md

@@ -0,0 +1,16 @@
+# Manual strategy switch permission control
+
+[简体中文](manual_strategy_switch_permission_control.zh-CN.md)
+
+Simplified permission model for a personal quant stack: you can switch strategies
+like Codex would, while keeping basic guardrails against mis-clicks and secret
+leakage.
+
+## Default: single-operator mode
+
+1. Only your GitHub account has write/admin on the runtime settings repository.
+2. Configure `RUNTIME_SETTINGS_GH_TOKEN` as a GitHub secret.
+3. Scope the token to the minimum variables/workflow permissions for target platform repos; do not grant `contents: write`.
+4. Run the workflow once with `apply=false` to review the preview before applying.
+
+See the Chinese note for the full checklist, fork guidance, and threat-model notes.

docs/manual_strategy_switch_permission_control.zh-CN.md

@@ -1,5 +1,7 @@
 # 手动策略切换权限控制方案
 
+[English](manual_strategy_switch_permission_control.md)
+
 这是个人量化系统的简化权限方案。默认目标不是做团队审批，而是让你自己能像让 Codex 切换一样直接操作，同时保留必要的防误触和防泄密边界。
 
 ## 默认方案：个人单人模式

docs/strategy_switch_admin_backend.md

@@ -1,5 +1,7 @@
 # Strategy Switch Admin Backend
 
+[简体中文](strategy_switch_admin_backend.zh-CN.md)
+
 Goal: keep the open-source switch page public and read-only by default, while allowing an authenticated admin to manage who can switch strategies and which account routes appear in the dropdown.
 
 ## Current Implementation

docs/strategy_switch_admin_backend.zh-CN.md

@@ -1,5 +1,7 @@
 # 策略切换登录权限后台
 
+[English](strategy_switch_admin_backend.md)
+
 目标：开源页面可以公开查看，但只有登录并通过权限校验的 GitHub 账号能一键切换策略；管理员可以自己维护登录名单和账号下拉，不需要每次改代码。
 
 ## 当前实现

docs/strategy_switch_architecture_security_review.md

@@ -0,0 +1,18 @@
+# Strategy switch console architecture and security review
+
+[简体中文](strategy_switch_architecture_security_review.zh-CN.md)
+
+Date: 2026-06-09
+
+## Summary
+
+The current design fits a personal quant system: the public page stays read-only;
+GitHub OAuth gates the Worker trigger; the `Manual Strategy Switch` workflow still
+performs the actual GitHub Variables write. This boundary is safer than a browser
+password plus front-end token, and simpler than a full approval backend.
+
+No Critical/High issues blocked release. Basic security response headers, same-origin
+`Origin` checks for state-changing requests, and DOM API rendering for the main
+switch page were added.
+
+See the Chinese review for architecture diagrams, threat notes, and follow-up items.

docs/strategy_switch_architecture_security_review.zh-CN.md

@@ -1,5 +1,7 @@
 # 策略切换控制台架构与安全 Review
 
+[English](strategy_switch_architecture_security_review.md)
+
 日期：2026-06-09
 
 ## 摘要

docs/strategy_switch_fork_guide.md

@@ -1,5 +1,7 @@
 # Fork Guide: Strategy Switch Console
 
+[简体中文](strategy_switch_fork_guide.zh-CN.md)
+
 This guide explains how to fork this repository and deploy the same public-readonly, login-to-switch console for your own platform repositories.
 
 ## What You Need

docs/strategy_switch_fork_guide.zh-CN.md

@@ -1,5 +1,7 @@
 # Fork 指南：策略切换控制台
 
+[English](strategy_switch_fork_guide.md)
+
 这份文档说明别人 fork 本仓库后，如何部署同样的“公开只读、登录后一键切换”策略控制台。
 
 ## 你需要准备什么