用 marknb 替换 Python markdown，并添加一键安装与升级脚本。

部署时通过 install.sh 自动编译 marknb；日常更新用 upgrade.sh 拉代码并重编译。

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -43,16 +43,40 @@
 - 单管理员后台：密码登录、CSRF、Session，够用且不繁琐。
 - 备案号挂载：`BLOG_ICP_TEXT` / `BLOG_ICP_URL` 环境变量直接生效，国内合规。
 - 反代友好：默认监听 `127.0.0.1:8765`，套 Nginx 即可上 HTTPS。
+- Markdown 引擎：[marknb](https://cnb.cool/whcself/marknb) — 零堆分配 C 解析器，比 Python `markdown` 更快，支持 GFM 表格与 LaTeX 透传。
 
 ### 30 秒上手
 
 ```bash
-git clone https://github.com/WHC2006/py-blog.git
+git clone https://cnb.cool/whcself/py-blog.git
 cd py-blog
-pip install -r requirements.txt
+bash scripts/install.sh
+source venv/bin/activate
 python blog.py
 ```
 
+`install.sh` 会自动从 [marknb](https://cnb.cool/whcself/marknb) 拉取源码、编译为 `vendor/marknb/libmarknb.so`，并创建 `venv` 安装 Python 依赖。
+
+### 升级
+
+已部署的站点拉取新版本后，一条命令完成代码、marknb 与 pip 依赖更新：
+
+```bash
+cd py-blog
+bash scripts/upgrade.sh
+source venv/bin/activate
+python blog.py   # 重启服务
+```
+
+`upgrade.sh` 会依次：`git pull` py-blog → 重编译 marknb → `pip install -U` 依赖。若尚未安装过，会自动回退执行 `install.sh`。
+
+### 脚本一览
+
+| 脚本 | 用途 |
+| --- | --- |
+| `scripts/install.sh` | 首次部署：系统依赖 + marknb 编译 + venv |
+| `scripts/upgrade.sh` | 日常升级：拉代码 + 重编译 marknb + 更新 pip |
+
 打开 <http://127.0.0.1:8765>，登录入口在 `/admin/login`。
 若没设置 `BLOG_ADMIN_PASSWORD`，**首次启动会在终端打印一次随机密码**，请立刻收好。
 
@@ -68,6 +92,7 @@ python blog.py
 | `BLOG_SECRET_KEY` | — | Session 签名密钥；未设置则自动生成并持久化 |
 | `BLOG_ICP_TEXT` | — | 页脚备案文案，例如 `京ICP备xxxxxx号-1` |
 | `BLOG_ICP_URL` | — | 备案查询链接，例如 `https://beian.miit.gov.cn/` |
+| `MARKNB_LIB` | `vendor/marknb/libmarknb.so` | marknb 动态库路径（可选） |
 
 ### Nginx 反代示例
 
@@ -143,16 +168,43 @@ But beginners also deserve a blog:
 - Built-in ICP footer (`BLOG_ICP_TEXT` / `BLOG_ICP_URL`) for hosting in China.
 - Reverse-proxy friendly: binds to `127.0.0.1:8765` by default; put Nginx
   in front for HTTPS.
+- Markdown engine: [marknb](https://cnb.cool/whcself/marknb) — zero-malloc C
+  parser, faster than Python `markdown`, with GFM tables and LaTeX passthrough.
 
 ### Quick start
 
 ```bash
-git clone https://github.com/WHC2006/py-blog.git
+git clone https://cnb.cool/whcself/py-blog.git
 cd py-blog
-pip install -r requirements.txt
+bash scripts/install.sh
+source venv/bin/activate
 python blog.py
 ```
 
+`install.sh` clones [marknb](https://cnb.cool/whcself/marknb), builds
+`vendor/marknb/libmarknb.so`, and creates a `venv` with Python deps.
+
+### Upgrade
+
+On an existing deployment, one command updates code, marknb, and pip packages:
+
+```bash
+cd py-blog
+bash scripts/upgrade.sh
+source venv/bin/activate
+python blog.py   # restart the service
+```
+
+`upgrade.sh` runs `git pull` → rebuild marknb → `pip install -U`. Falls back
+to `install.sh` if no `venv` exists yet.
+
+### Scripts
+
+| Script | Purpose |
+| --- | --- |
+| `scripts/install.sh` | First deploy: system deps + marknb build + venv |
+| `scripts/upgrade.sh` | Routine upgrade: pull + rebuild marknb + pip update |
+
 Open <http://127.0.0.1:8765>. Admin login lives at `/admin/login`.
 If `BLOG_ADMIN_PASSWORD` is unset, **a random password is printed once** to
 the terminal on first boot — copy it immediately.
@@ -169,6 +221,7 @@ the terminal on first boot — copy it immediately.
 | `BLOG_SECRET_KEY` | — | Session signing key; auto-generated and persisted if unset |
 | `BLOG_ICP_TEXT` | — | Footer ICP text (China hosting) |
 | `BLOG_ICP_URL` | — | Footer ICP link |
+| `MARKNB_LIB` | `vendor/marknb/libmarknb.so` | Path to marknb shared library (optional) |
 
 ### Nginx reverse proxy