[fleizean]

Summary

Make the issue-first contribution flow the default and document it: open an issue, open a linked pull request early, continue on the pull request.

Why

Closes #18. Today CONTRIBUTING.md only asks for an issue "for a larger change" and nothing ties a pull request back to its issue. Issue-first with a linked PR gives every change a tracked rationale, lets reviewers follow work in progress, and keeps develop history traceable.

Changes

• CONTRIBUTING.md — every change starts with an issue; branch from develop, open the pull request early (draft is fine), and link it with Closes #NNN. Security still routes through SECURITY.md.
• .github/pull_request_template.md — a Closes # line in Why and a matching checklist item make the linked issue explicit.
• .github/ISSUE_TEMPLATE/ — bug_report, feature_request and chore templates, plus config.yml that disables blank issues and points security reports to the private policy.

Notes for reviewers

• Docs and GitHub config only; no code, no dependencies.
• This PR dogfoods the flow it introduces (opened from Adopt issue-first contribution flow with linked PRs #18 with a linked draft-friendly PR).

Checklist

• This pull request is linked to an issue (Closes #18 above)
• The pull request targets develop and is about one thing
• Commit messages follow Conventional Commits (docs: ..., chore: ...)
• CI is green (backend tests, frontend build and tests, dependency gate)
• Schema changes are EF Core migrations generated by the tool, not hand-edited (none)
• A changed backend DTO has its TypeScript twin updated (none)
• New dependencies are justified and their lock files are updated in the same commit (none)
• No secrets, tokens or personal data in code, logs or this description
• Code comments are kept to a minimum; the reasoning lives in this description