chore: add GitHub community files and CI pipeline

- .github/workflows/ci.yml: TypeScript check + Vitest + build on every PR
- .github/dependabot.yml: weekly npm + Actions updates (minor/patch grouped)
- .github/ISSUE_TEMPLATE/: bug_report, feature_request, config (→ Discussions)
- .github/PULL_REQUEST_TEMPLATE.md: checklist for contributors
- SECURITY.md: responsible disclosure policy via GitHub Advisories
- CONTRIBUTING.md: dev setup, code style, commit conventions

SECURITY.md

@@ -0,0 +1,44 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release on `main` is actively maintained.
+
+| Version | Supported |
+|---|---|
+| `main` (latest) | ✅ |
+| older commits | ❌ |
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub Issues.**
+
+Instead, use one of these private channels:
+
+- **GitHub Security Advisories** (preferred): [Open a draft advisory](https://github.com/ralksta/immich-folio/security/advisories/new)
+- **Email**: contact the maintainer via the email listed on the GitHub profile
+
+### What to include
+
+- Description of the vulnerability and potential impact
+- Steps to reproduce (minimal reproduction if possible)
+- Affected versions / configurations
+- Any proposed fix or mitigation
+
+### Response timeline
+
+- **Acknowledgement**: within 48 hours
+- **Triage & assessment**: within 7 days
+- **Fix & coordinated disclosure**: within 30 days for critical issues
+
+## Scope
+
+immich-folio acts as a **reverse proxy** in front of your private Immich instance. Security issues in scope include:
+
+- Authentication / session bypass
+- API key / secret leakage
+- XSS vulnerabilities in gallery pages or lightbox
+- Rate-limiting bypass enabling DoS
+- Insecure Docker defaults that expose the Immich backend
+
+Out of scope: vulnerabilities in Immich itself (report those upstream at [immich.app](https://immich.app)).