Say thank you where people can see it

The contributor graph has carried every outside author correctly, because
fork pull requests are merged as merge commits and the authorship
survives onto main. But nobody reads a graph tab. The front page now
names the practice and renders the graph inline, so a first-time
contributor sees their own avatar on the page they landed on.

The avatar strip comes from a third-party renderer, the same class of
service as the four shields badges already at the top, and GitHub proxies
it so no visitor address reaches that host. It is generated rather than
hand-written on purpose: a hand-kept list is the kind of thing that goes
stale quietly.

README.md

@@ -107,6 +107,21 @@ Next.js 16 (App Router, React Server Components), TypeScript strict, PostgreSQL
 
 Actively developed — new releases roughly weekly, issue reports and PRs welcome. Behaviour and schema can change between versions; migrations are forward-only.
 
+## Thanks
+
+HealthLog is built in the open and people keep making it better. Alongside
+bug reports, setup questions and the ideas that turned into features, these
+people have sent code that shipped:
+
+<a href="https://github.com/MBombeck/HealthLog/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=MBombeck/HealthLog" alt="Contributors to HealthLog" />
+</a>
+
+Every merged pull request keeps its author's name on the commit, so the
+[contributor graph](https://github.com/MBombeck/HealthLog/graphs/contributors)
+is the full list. Release notes name the people whose work is in that release,
+including anyone who found the defect without sending the fix.
+
 ## License
 
 HealthLog is licensed under the [PolyForm Noncommercial License 1.0.0](LICENSE): free to use, self-host, and modify for noncommercial purposes. Commercial use requires a separate agreement — open an issue or reach out via [healthlog.dev](https://healthlog.dev). Releases up to and including v1.15.18 were published under AGPL-3.0 and remain available under that license.