docs: add PR template and security policy

- Add .github/PULL_REQUEST_TEMPLATE.md with checklist for contributors
- Add SECURITY.md with vulnerability reporting instructions

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,25 @@
+## Description
+
+<!-- What does this PR do? Why is it needed? -->
+
+## Type of Change
+
+- [ ] 🐛 Bug fix
+- [ ] ✨ New feature
+- [ ] 💅 Style / UI change
+- [ ] ♻️ Refactor (no behavior change)
+- [ ] 📝 Documentation
+- [ ] 🧪 Tests
+- [ ] 🔧 Build / CI / tooling
+
+## Checklist
+
+- [ ] `npm run build` passes with zero errors
+- [ ] Tested in browser (dev server or production build)
+- [ ] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/)
+- [ ] No secrets or credentials included
+- [ ] Translations updated in `src/lib/i18n.ts` if UI text changed
+
+## Screenshots
+
+<!-- If this changes the UI, add before/after screenshots or a short GIF -->