chore: bootstrap repo scaffolding (M0.1)

Adds the §1.2 scaffolding required by IMPLEMENTATION_PLAN.md M0.1:
README, CONTRIBUTING, CODEOWNERS, CHANGELOG, PR + issue templates,
CI workflow, release workflow, LICENSE, commitlint, cliff config,
.editorconfig, .gitignore, .env.example.

Refs: M0.1

CODEOWNERS

@@ -0,0 +1,35 @@
+# CODEOWNERS — auto-requests reviewers based on touched paths.
+# Format: <path-glob>  <@user-or-team> [<@user-or-team> ...]
+# More specific patterns override less specific ones.
+# See: https://docs.gitea.com/usage/code-owners
+#
+# This is the BASELINE — copy into the repo and tighten paths per service.
+
+# Default — every PR gets at least Sharang
+*                                   @sharang
+
+# Architecture / specs / runbooks (touchy — both founders look)
+/docs/                              @sharang @benjamin_boenisch
+*.md                                @sharang @benjamin_boenisch
+
+# Security-sensitive paths
+/internal/auth/                     @sharang
+/internal/keycloak/                 @sharang
+/internal/api-keys/                 @sharang
+/middleware/auth/                   @sharang
+
+# Schema and data migrations — irreversible, both founders look
+/migrations/                        @sharang @benjamin_boenisch
+**/schema/                          @sharang @benjamin_boenisch
+
+# Infra-as-code
+/orca/                              @sharang
+/.gitea/workflows/                  @sharang
+/Dockerfile                         @sharang
+
+# Manifests (catalog metadata visible to customers)
+/product.manifest.yaml              @sharang @benjamin_boenisch
+
+# Frontend-only changes
+/src/app/                           @sharang
+/src/components/                    @sharang