feat: issue templates, SECURITY.md, CODEOWNERS, commitlint

[cekuu35]

Closes #870

What

• `.github/ISSUE_TEMPLATE/bug_report.yml`: bug template (route, steps, expected vs actual, console output, environment, screenshots, pre-submit checks).
• `.github/ISSUE_TEMPLATE/feature_request.yml`: feature template (problem, suggested direction, scope, context).
• `.github/ISSUE_TEMPLATE/config.yml`: routes security reports to the `SECURITY.md` channel instead of the public tracker; links Discussions for support.
• `SECURITY.md`: private reporting policy (advisory or DM), 2-business-day acknowledgment, supported-version statement.
• `.github/CODEOWNERS`: marks auth, payments, portfolio, `src/services/` and build config as code-owned so security-sensitive changes reach the right reviewers.
• `commitlint.config.js` + `.husky/commit-msg` + `.github/workflows/commitlint.yml`: the documented conventional-commit rule (CONTRIBUTING.md:134-137) is now machine-checked locally and in CI. New `npm run commitlint` script.

Notes

• The PR template with a `Closes #` field and the CONTRIBUTING checklist lands in ci: add workflow running the full CONTRIBUTING.md gate #891 (where the CI gate lives), to avoid two PRs touching `PULL_REQUEST_TEMPLATE.md`.
• `CODEOWNERS` uses `@Dfunder` as the default owner placeholder ? may need adjusting once the actual reviewer team is finalized.
• No lockfile change beyond adding `@commitlint/cli@^19` + `@commitlint/config-conventional@^19`.