chore: establish project maintenance baseline

[nrps9909]

Summary

• add the repository's first project-level CI checks for first-party JavaScript, Python, and Docker Compose configuration
• add weekly npm and monthly GitHub Actions Dependabot updates
• add contribution, security, issue, and pull-request guidance
• align README and npm metadata with the existing GPL-3.0 license and replace the ambiguous .env template with .env.example
• fix an undeclared lesson_plan variable that throws in ES module strict mode

Closes #52.

Validation

• npm ci --prefix frontend
• npm run check --prefix frontend
• python3 -m compileall -q flask_server
• docker compose config --quiet
• parsed every new YAML file
• git diff --check

npm ci still reports 11 existing dependency advisories (6 moderate, 4 high, 1 critical). This PR does not hide or gate on that pre-existing backlog; the new Dependabot configuration establishes a reviewable follow-up path.

Checklist

• I kept this pull request focused on one change.
• I tested the affected behavior or explained why it could not be tested.
• I did not include credentials, student data, recordings, or other private data.
• I updated documentation when user-facing setup changed.
• My contribution is compatible with the repository's GPL-3.0 license.

Prepared with Codex assistance; the commands above were run against this branch.