chore(release): prepare 0.87.1

Cargo.toml

@@ -61,7 +61,7 @@ categories = ["network-programming", "web-programming::http-server"]
 
 # 二进制走 CalVer，crate 走 SemVer —— 两者是两回事，卖给不同的人。
 # 这里是 crate 的版本。
-version = "0.87.0"
+version = "0.87.1"
 
 [workspace.dependencies]
 # ── 内部 crate ───────────────────────────────────────────

release-notes/0.87.1.md

@@ -0,0 +1,13 @@
+This release keeps upstreams with insufficient credits or exhausted quota out of later requests, including when an upstream returns its error inside an HTTP 200 event stream.
+
+**Upgrade notes**
+
+- The control-plane protocol version stays at 58; ThinkWatch Lite releases that include 0.87.0 also connect to 0.87.1.
+- The request store's schema stays at 28; nothing is cleared.
+- Existing configurations are unchanged. No new message codes.
+
+**Insufficient credits ([#379](https://github.com/ThinkWatchProject/ThinkWatch-Core/pull/379)).** JSON error fields are decoded before balance failures are classified, so escaped insufficient-credit messages trigger failover and pause the affected upstream. Credit mentions in echoed requests or metadata do not turn a client error into a balance failure.
+
+**Errors inside streamed answers.** An upstream that returns HTTP 200 followed by an SSE error and a clean end of stream is no longer recorded as a success before its error is inspected. Balance and quota failures pause the upstream, server and authentication failures use the existing circuit breaker, and rate limits pause the upstream without adding a success or failure sample. A final error frame is recognized even without a trailing blank line. The original error still reaches the client, and an answer that has already delivered content is never replayed.
+
+**Watcher tests.** Filesystem integration tests no longer assume that writes finish within one debounce window or that a quiet event channel means descriptor handover has completed. Exact event batching and descriptor leak checks remain covered. Production watcher behavior is unchanged.