feat: 统一服务缓存 + 指纹驱动插件匹配

将 webServiceCache 扩展为通用 serviceCache，所有指纹识别结果
统一缓存，插件匹配时端口不命中则回退到服务名称匹配。

删除多余的 service_cache.go，复用已有的 ServiceInfo 体系。
补充 nil 防御、Explicit 标记、大量单元/集成/回归测试。

plugins/init_test.go

@@ -192,9 +192,9 @@ func TestGenerateCredentials_PlaceholderReplacement(t *testing.T) {
 
 	// 验证：{user} 被正确替换
 	expectedCombos := map[string]string{
-		"root:root":     "root",   // {user} → root
-		"root:root123":  "root",   // {user}123 → root123
-		"mysql:mysql":   "mysql",  // {user} → mysql
+		"root:root":      "root",  // {user} → root
+		"root:root123":   "root",  // {user}123 → root123
+		"mysql:mysql":    "mysql", // {user} → mysql
 		"mysql:mysql123": "mysql", // {user}123 → mysql123
 	}
 
@@ -244,7 +244,7 @@ func TestGenerateCredentials_DefaultValues(t *testing.T) {
 
 	cfg.Credentials.UserPassPairs = []config.CredentialPair{}
 	cfg.Credentials.Userdict = map[string][]string{} // 空字典
-	cfg.Credentials.Passwords = []string{}          // 空密码列表
+	cfg.Credentials.Passwords = []string{}           // 空密码列表
 
 	result := GenerateCredentials("unknown_service", cfg)
 
@@ -327,3 +327,27 @@ func TestGenerateCredentials_EmptyUserPassPairs(t *testing.T) {
 
 	t.Logf("✓ 空 UserPassPairs 正确回退到笛卡尔积")
 }
+
+func TestBuildConfigAdditionalPasswordsAreNotShadowedByExactPair(t *testing.T) {
+	cfg, _, err := common.BuildConfig(&common.FlagVars{
+		Username:     "root",
+		Password:     "primary",
+		AddPasswords: "extra",
+	}, &common.HostInfo{})
+	if err != nil {
+		t.Fatalf("BuildConfig error = %v", err)
+	}
+
+	result := GenerateCredentials("ssh", cfg)
+	found := map[string]bool{}
+	for _, cred := range result {
+		found[cred.Username+":"+cred.Password] = true
+	}
+
+	if !found["root:primary"] {
+		t.Fatal("missing primary password credential")
+	}
+	if !found["root:extra"] {
+		t.Fatal("additional password was shadowed by exact user/password pair")
+	}
+}