chore: add GitHub community files and CI pipeline

- .github/workflows/ci.yml: TypeScript check + Vitest + build on every PR
- .github/dependabot.yml: weekly npm + Actions updates (minor/patch grouped)
- .github/ISSUE_TEMPLATE/: bug_report, feature_request, config (→ Discussions)
- .github/PULL_REQUEST_TEMPLATE.md: checklist for contributors
- SECURITY.md: responsible disclosure policy via GitHub Advisories
- CONTRIBUTING.md: dev setup, code style, commit conventions

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,47 @@
+---
+name: "\U0001F41B Bug report"
+about: Something isn't working as expected
+title: "[bug] "
+labels: bug
+assignees: ''
+---
+
+## Describe the bug
+
+A clear description of what the bug is.
+
+## Steps to reproduce
+
+1. Go to '...'
+2. Click on '...'
+3. See error
+
+## Expected behavior
+
+What you expected to happen.
+
+## Actual behavior
+
+What actually happened. Include screenshots if relevant.
+
+## Environment
+
+| Field | Value |
+|---|---|
+| immich-folio version | vX.X.X / commit SHA |
+| Immich version | |
+| Deployment | Docker / manual |
+| Browser | Chrome / Firefox / Safari |
+| OS | |
+
+## `content/gallery.yaml` (redacted)
+
+```yaml
+# Paste a minimal reproduction of your config here (remove any tokens/passwords!)
+```
+
+## Logs
+
+```
+# Paste relevant Docker / console logs here
+```

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: "\U0001F4AC Discussions (Questions & Ideas)"
+    url: https://github.com/ralksta/immich-folio/discussions
+    about: Please use Discussions for general questions and ideas instead of issues.
+  - name: "\U0001F512 Security vulnerability"
+    url: https://github.com/ralksta/immich-folio/security/advisories/new
+    about: Please report security vulnerabilities privately via GitHub's Security Advisories.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,27 @@
+---
+name: "\U0001F4A1 Feature request"
+about: Suggest an idea or improvement
+title: "[feat] "
+labels: enhancement
+assignees: ''
+---
+
+## Summary
+
+A brief description of the feature you'd like to see.
+
+## Problem / motivation
+
+What problem does this solve? Is it connected to a specific workflow?
+
+## Proposed solution
+
+Describe the solution you'd like.
+
+## Alternatives considered
+
+Any alternative approaches you've thought about?
+
+## Additional context
+
+Screenshots, mockups, links to similar implementations, etc.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,27 @@
+## Summary
+
+<!-- What does this PR do? Reference the issue it closes if applicable. -->
+Closes #
+
+## Type of change
+
+- [ ] 🐛 Bug fix
+- [ ] ✨ New feature
+- [ ] 🎨 Style / visual
+- [ ] ♻️ Refactor
+- [ ] 🔒 Security fix
+- [ ] 📝 Documentation
+- [ ] 🛠️ Build / CI
+
+## Checklist
+
+- [ ] `npm run build` passes locally
+- [ ] `npx tsc --noEmit` passes (0 type errors)
+- [ ] `npx vitest run` passes (all tests green)
+- [ ] No secrets / API keys in diff
+- [ ] Documentation updated if needed (`docs/`, `README.md`)
+- [ ] Screenshots attached if there are visual changes
+
+## Screenshots (if applicable)
+
+<!-- Before / After -->

.github/dependabot.yml

@@ -0,0 +1,42 @@
+version: 2
+
+updates:
+  # npm dependencies
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "Europe/Berlin"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+    groups:
+      # Batch minor/patch Next.js updates together
+      nextjs:
+        patterns:
+          - "next"
+          - "eslint-config-next"
+      # Batch React updates
+      react:
+        patterns:
+          - "react"
+          - "react-dom"
+          - "@types/react*"
+    ignore:
+      # Don't auto-update major versions (review manually)
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "Europe/Berlin"
+    labels:
+      - "dependencies"
+      - "github-actions"

.github/workflows/ci.yml

@@ -0,0 +1,43 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+# Cancel in-progress runs for the same PR / branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ci:
+    name: Type-check & Test
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: TypeScript – type check
+        run: npx tsc --noEmit
+
+      - name: Run tests
+        run: npx vitest run
+
+      - name: Build
+        run: npm run build
+        env:
+          # Minimal env vars so Next.js build doesn't bail early on env validation
+          IMMICH_URL: http://localhost:2283
+          IMMICH_API_KEY: placeholder-key-for-ci