chore: add open-source governance files (GPLv3 + contributing docs)

Add standard open-source project files:
- LICENSE.md — GNU GPL v3.0 or later (verbatim)
- CONTRIBUTING.md — setup, workflow, and required AI-usage disclosure
- CONTRIBUTORS.md — maintainers, contributors, AI-assistance policy
- CODE_OF_CONDUCT.md — Contributor Covenant 2.1
- SECURITY.md — private vulnerability reporting
- .gitea/ISSUE_TEMPLATE/* + PULL_REQUEST_TEMPLATE.md
- README: License section (Copyright (C) 2026 Runic Gateway)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XmHdsbnLzDMAVQkAoTQSBe

CONTRIBUTING.md

@@ -0,0 +1,89 @@
+# Contributing to Runic Gateway — uo-link sidecar
+
+Thanks for your interest in contributing! This repo is the **Rust sidecar** half
+of the game bridge: it terminates the loopback link from the ServUO shard and
+exposes the WebSocket + REST API the website consumes.
+
+By participating you agree to abide by our
+[Code of Conduct](CODE_OF_CONDUCT.md).
+
+## Ways to contribute
+
+- **Report a bug** or **request a feature** through the
+  [issue tracker](https://gitea.whitlocktech.com/RunicGateway/link/issues)
+  (issue templates are provided).
+- **Improve the code or docs** by opening a pull request (see below).
+- **Never** report a security vulnerability in a public issue — see
+  [SECURITY.md](SECURITY.md). The sidecar is the only network-facing part of the
+  bridge, so its security matters.
+
+## Development setup
+
+**Prerequisites:** a recent stable Rust toolchain (install via
+[rustup](https://rustup.rs/)).
+
+The sidecar is a standard cargo crate under `sidecar/`:
+
+```bash
+cd sidecar
+cp sidecar.toml.example sidecar.toml   # then edit
+cargo build --release                  # binary at target/release/uo-link-sidecar
+cargo run --release
+```
+
+See [`sidecar/README.md`](sidecar/README.md) for configuration and the wire
+protocol. The loopback JSON protocol shared with the ServUO plugin
+([RunicGateway/servuo-plugins](https://gitea.whitlocktech.com/RunicGateway/servuo-plugins))
+is a **compatibility contract** — the canonical spec lives in the
+[docs repo](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link).
+If you change an event or command, keep both sides and the spec in sync.
+
+### Checks
+
+Please make sure the crate builds cleanly and is formatted and lint-clean before
+opening a PR:
+
+```bash
+cargo fmt --all
+cargo clippy --all-targets -- -D warnings
+cargo test
+cargo build --release
+```
+
+## Branch & PR workflow
+
+1. Branch from `main` with a descriptive name
+   (`feature/…`, `fix/…`, `docs/…`, `chore/…`).
+2. Keep changes focused; small PRs are easier to review.
+3. Push and open a pull request against `main`. Fill out the PR template,
+   including the **AI-assisted contributions** disclosure.
+4. A maintainer will review; address feedback with follow-up commits.
+
+### Commit messages
+
+We use [Conventional Commits](https://www.conventionalcommits.org/) —
+`type(scope): summary`. Note the release workflow
+(`.gitea/workflows/release.yml`) derives versions from conventional commits on
+`main`, so accurate `feat:` / `fix:` prefixes matter here.
+
+## AI-assisted contributions (disclosure required)
+
+This project is developed openly with AI assistance, and we ask the same
+transparency of everyone. **If you used an AI tool** (Claude, Copilot, ChatGPT,
+Cursor, etc.) to help produce a contribution, you must disclose it:
+
+- Tick the AI-usage box in the pull-request template and name the tool(s).
+- Mark AI-authored commits with a trailer, e.g.
+  `Co-Authored-By: Claude <noreply@anthropic.com>` or `Assisted-By: <tool>`.
+- You remain responsible for every line you submit: review it, understand it,
+  and make sure it is correct and that you have the right to contribute it.
+
+Disclosed AI assistance is welcome. Undisclosed AI-generated contributions are
+not, and may be closed.
+
+## License
+
+Runic Gateway is licensed under the **GNU General Public License v3.0 or later**
+(see [LICENSE.md](LICENSE.md)). By submitting a contribution you agree that it is
+licensed under the same terms (inbound = outbound) and that you have the right to
+contribute it.