chore: bootstrap repo scaffolding (M0.1)

Adds the §1.2 scaffolding required by IMPLEMENTATION_PLAN.md M0.1:
README, CONTRIBUTING, CODEOWNERS, CHANGELOG, PR + issue templates,
CI workflow, release workflow, LICENSE, commitlint, cliff config,
.editorconfig, .gitignore, .env.example.

Refs: M0.1

.gitea/pull_request_template.md

@@ -0,0 +1,66 @@
+<!--
+PR title MUST be a Conventional Commit, e.g.:
+  feat(api): add POST /v1/tenants/:id/cancel
+  fix(auth): reject JWT when org_id missing
+
+Mark draft if not ready for review.
+-->
+
+## What
+
+<!-- 1–3 bullets. What does this PR change? -->
+-
+
+## Why
+
+<!-- Link the architecture section, milestone ID, or issue this addresses. -->
+
+Linked milestone: **M5.1**
+
+<!-- Optional: closes #123, refs #456 -->
+
+## How
+
+<!-- Notes for the reviewer: the interesting design choices, the tricky bits, what NOT to focus on. Skip if obvious from the diff. -->
+
+## Test plan
+
+- [ ] Unit tests added/updated
+- [ ] Integration tests added/updated (real DB via testcontainers)
+- [ ] Playwright e2e added/updated (only if user-facing flow changed)
+- [ ] Manual smoke on stage after deploy
+- [ ] Regression test added (only if this PR fixes a bug — must fail before the fix)
+
+<!-- If a row is genuinely n/a, leave it unchecked and explain below. -->
+
+## Risk
+
+**Blast radius:** <!-- single tenant / all tenants / single product / portal-wide / data-plane / infra -->
+
+**What could break:**
+-
+
+**Rollback plan:**
+<!-- e.g. `orca rollout undo {service} --env=prod`, or "revert the PR and redeploy" -->
+
+## Checklist
+
+- [ ] Docs updated (or n/a — explain)
+- [ ] Audit events emitted for state changes (or n/a)
+- [ ] Secrets via Infisical, never in repo
+- [ ] Migration is forward-only + idempotent (or no migration)
+- [ ] Tenant scoping enforced on every DB query (or no DB access)
+- [ ] OpenAPI spec updated (or no API change)
+- [ ] `featureFlags.evaluate()` used for any toggleable behavior (or n/a)
+- [ ] CHANGELOG entry under "Unreleased" (or n/a)
+
+## Screenshots / recordings
+
+<!-- For UI changes. Drop a screenshot or a Loom link. -->
+
+---
+
+<!--
+Reviewer reminder: in this order — risk → tests → security → correctness → style.
+Squash-merge after approval. PR title becomes the commit message.
+-->