Really huge mass update; Getting everything up-to-spec and implementing a wide range of features

CONTRIBUTING.md

@@ -0,0 +1,76 @@
+# Contributing
+
+Thanks for working on PR Previews. This project is a self-hosted Gitea PR
+preview service; the product behavior source of truth is `SPEC.md`.
+
+## Before You Change Code
+
+- Read `AGENTS.md` for repository-specific implementation rules.
+- Check `SPEC.md` when behavior is ambiguous.
+- Use `pnpm`, not npm or yarn.
+- Keep Prisma commands pointed at `../prisma/schema.prisma` from `backend/`.
+- Do not commit generated secrets, `.env` files, EC2 keys, tokens, or database dumps.
+
+## Development Setup
+
+Start the database:
+
+```bash
+docker compose up -d pp-db
+```
+
+Apply migrations:
+
+```bash
+cd backend
+pnpm migrate
+```
+
+Run the backend:
+
+```bash
+cd backend
+pnpm install
+pnpm dev
+```
+
+Run the frontend:
+
+```bash
+cd frontend
+pnpm install
+pnpm dev
+```
+
+## Validation
+
+There is no automated test runner in this repository yet. Before opening a PR,
+run the relevant builds:
+
+```bash
+cd backend
+pnpm build
+```
+
+```bash
+cd frontend
+pnpm build
+```
+
+For behavior changes, also verify the running stack manually with a Gitea PR or
+with the narrowest API/UI flow that exercises the change.
+
+## Pull Request Guidelines
+
+- Keep changes scoped to one behavior or cleanup.
+- Explain user-visible behavior changes clearly.
+- Include migration notes when changing `prisma/schema.prisma`.
+- Preserve the existing security model: encrypted stored secrets, masked logs,
+  constant-time webhook signature checks, and no secret values in API responses.
+- Update `README.md`, `SPEC.md`, or `AGENTS.md` when the change affects setup,
+  product behavior, or contributor workflow.
+
+## License
+
+By contributing, you agree that your contributions are licensed under the Apache
+License, Version 2.0. See `LICENSE`.