chore(module-uo): bootstrap repo with governance docs and templates

First commit for the UO module — the game-specific half of the Runic Gateway
website, extracted from core so that core can become game-agnostic. Phase 0 of
the module system plan (docs/website/MODULE_SYSTEM.md §2.7) calls for this repo
to get its initial commit before any module work starts.

Governance scaffolding only; no module code. The design of record settles the
API surface in Phase 1 and Phase 3 is what fills the repo, so writing module
code now would be writing against a contract that does not exist yet.

- README.md          what module-uo is, the phase table, the packaging layout,
                     and why an operator never builds anything
- CONTRIBUTING.md    planning status, the dev loop (a module is not runnable on
                     its own), the zero-internal-imports and one-path-segment
                     rules, schema fragments instead of migrations
- SECURITY.md        private reporting, plus the module-specific notes: the
                     module boundary is not a security boundary, access control
                     lives in core, and the uo-link token stays write-only
- CODE_OF_CONDUCT.md, CONTRIBUTORS.md, LICENSE.md (GPL-3.0-or-later),
  PR + issue templates — the same set every repo in the org carries
- .gitignore         Node-shaped; client/dist/ is ignored deliberately, since it
                     is a release artifact built by CI, not a source artifact

CI lands next, in a PR, mirroring how the installer repo was bootstrapped: an
empty repo cannot take a pull request, but everything after it can.

Co-Authored-By: Claude <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,37 @@
+# dependencies
+node_modules/
+server/node_modules/
+client/node_modules/
+
+# Built client half. This is a RELEASE artifact, not a source artifact: CI builds
+# it with Vite in library mode and publishes it inside module-uo-<version>.tar.gz,
+# because an operator must never have to build anything. Committing it would let a
+# stale chunk ship alongside fresh server code.
+client/dist/
+
+# test coverage
+coverage/
+server/coverage/
+client/coverage/
+
+# env / secrets
+.env
+*.env
+!.env.example
+
+# Release staging
+*.tar.gz
+
+# logs / os
+*.log
+npm-debug.log*
+.DS_Store
+Thumbs.db
+
+# editor / tooling local settings
+.claude/settings.local.json
+.vscode/
+.idea/
+
+# local planning docs (not part of the tracked codebase)
+.plans/