Community files and CI, now that the repository is public

It had none: no security policy, no contributing guide, no code of conduct,
no sponsor link, and no CI. A public repository with an administrative
interface in it should at least say where to send a vulnerability, so that
part names what is worth reporting here specifically -- a session acting
beyond its permissions, one tenant's data reaching another, a token landing
somewhere that outlives the session -- and where a report goes if it turns
out to belong to the server or to upstream.

CI is what a contributor can run: typecheck, lint, test, build. Nothing in
it needs a live server, so a red run means the code, not the runner.

CONTRIBUTING.md

@@ -0,0 +1,29 @@
+# Contributing
+
+Patches, bug reports and questions are welcome. Open an issue first for
+anything substantial; small fixes need no ceremony.
+
+## What this is
+
+A fork of Stalwart's web interface, taken under the AGPL-3.0-only half of its
+dual licence, talking to INBUXA over JMAP and OAuth. Upstream's copyright
+headers stay where they are, and a file this fork has changed says so beneath
+them. New files carry Coffey Labs' own header and `AGPL-3.0-only`.
+
+Changes to files that came from upstream are kept small, so the next import
+merges cleanly and a reader can tell fork from base.
+
+## Before you push
+
+```
+npm ci
+npm run typecheck && npm run lint && npm test && npm run build
+```
+
+CI runs exactly that. Nothing here talks to a live server, so a failing test
+is a real failure rather than a missing container.
+
+## Commit messages
+
+Say what changed and why, in prose. The why is the part that is hard to
+recover later. No tool trailers.