chore: make the project discoverable (CI, container, community files, README)

.github/CODE_OF_CONDUCT.md

@@ -0,0 +1,42 @@
+# Code of Conduct
+
+## The short version
+
+Be decent. Assume the person on the other end is acting in good faith and is
+busy. Quidly is a small project maintained in someone's spare time.
+
+## Expected behaviour
+
+- Keep criticism about the code, not the person.
+- Accept that "no" is a legitimate answer to a feature request, and that
+  maintainers get to scope their own project.
+- Remember that people file issues about their own tax affairs. Treat financial
+  details someone shares in an issue as something they trusted you with, and
+  don't repost it elsewhere.
+
+## Unacceptable behaviour
+
+- Harassment, insults, or personal attacks.
+- Discriminatory language or imagery, or unwelcome sexual attention.
+- Publishing others' private information without permission.
+- Sustained disruption of discussions, or demanding free labour.
+
+## Scope
+
+This applies to all project spaces — issues, pull requests, discussions,
+commit messages — and to public spaces when someone is representing the project.
+
+## Enforcement
+
+Report problems to the maintainer via
+[a private security advisory](https://github.com/WarlaxZ/quidly/security/advisories/new)
+if the report itself is sensitive, or by opening an issue if it isn't.
+
+The maintainer may warn, edit or remove contributions, or block accounts.
+Enforcement decisions rest with the maintainer, who will act in proportion to
+what happened.
+
+## Attribution
+
+Adapted in spirit from the [Contributor Covenant](https://www.contributor-covenant.org),
+shortened to match the size of the project.

.github/CONTRIBUTING.md

@@ -0,0 +1,73 @@
+# Contributing to Quidly
+
+Thanks for taking an interest. Quidly is a self-hosted bookkeeping app for UK
+landlords, and it deals with people's tax returns — so correctness matters more
+here than velocity.
+
+## Ground rules
+
+- **Money is integer pence, end-to-end.** There is no floating-point arithmetic
+  anywhere in the money path. If a change introduces a `number` that represents
+  a fractional currency amount, it will be rejected. Store pence, format at the
+  edge.
+- **Tax logic needs a test and a source.** Any change to rates, bands, or
+  thresholds must cite the HMRC page it came from in the PR description, and
+  come with a test that pins the expected figure.
+- **This is not the Next.js you may know.** Quidly is on Next.js 16. Read the
+  relevant guide under `node_modules/next/dist/docs/` before writing app code —
+  APIs and conventions differ from older versions.
+- **Prisma v7 conventions.** The datasource URL lives in `prisma.config.ts`.
+  Migrations are hand-authored SQL applied with `prisma migrate deploy` — not
+  `migrate dev`.
+
+## Getting set up
+
+```bash
+npm install
+npm run set-password            # paste the DEV (backslash-escaped) hash into .env
+# .env also needs SESSION_SECRET=... (openssl rand -base64 32) and DATABASE_URL="file:./dev.db"
+npx prisma migrate deploy
+npx prisma db seed
+npm run dev                     # http://localhost:3000
+```
+
+## Before you open a PR
+
+```bash
+npm test          # vitest
+npm run typecheck # tsc --noEmit
+npm run build     # next build
+```
+
+All three run in CI on every PR. Green locally means green there.
+
+## Scope
+
+Quidly is deliberately **single-user per install** and **UK-first**. Two kinds
+of proposal are usually out of scope:
+
+- Multi-tenancy, user management, or role systems.
+- Tax regimes for other countries.
+
+If you want either, a fork is a completely reasonable answer — the AGPL exists
+for exactly that.
+
+Good places to start, in rough order of how much they help:
+
+1. **Tax-year rates.** Each April, rates and thresholds change. Updating a rate
+   year is well-scoped and high-value.
+2. **Bank CSV formats.** More UK bank export formats parsed out of the box.
+3. **Bug reports with a reproduction.** Genuinely valuable even without a fix.
+
+## Reporting bugs
+
+Use the issue templates — they ask for the version, whether you're on Docker or
+a dev install, and the tax year, which is almost always what a diagnosis turns
+on. For anything security-related, see [SECURITY.md](SECURITY.md) instead; do
+not open a public issue.
+
+## Licence
+
+Quidly is AGPL-3.0. By contributing you agree your contribution is licensed
+under the same terms. Note the AGPL's network clause: if you run a modified
+Quidly as a service that others use, you must offer them your changes.

.github/FUNDING.yml

@@ -0,0 +1,8 @@
+# Uncomment a line once the corresponding account is set up. GitHub shows a
+# "Sponsor" button on the repo for whichever of these are populated, and an
+# unconfigured platform is left out rather than shown as broken.
+#
+# github: [WarlaxZ]          # requires GitHub Sponsors to be enabled first
+# ko_fi: yourhandle
+# buy_me_a_coffee: yourhandle
+# custom: ["https://example.com/sponsor-quidly"]

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,118 @@
+name: Bug report
+description: Something isn't working the way it should
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting this. Please don't paste real financial data —
+        redact figures and addresses, or make up equivalent numbers.
+
+        If this is a security issue, **stop** and use
+        [private vulnerability reporting](https://github.com/WarlaxZ/quidly/security/advisories/new)
+        instead.
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: What did you see, and what did you expect instead?
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Go to Transactions
+        2. Add an expense of £120 against property X
+        3. Open the SA105 page
+        4. Box 20 shows £0 instead of £120
+    validations:
+      required: true
+
+  - type: dropdown
+    id: install-method
+    attributes:
+      label: How are you running Quidly?
+      options:
+        - Docker (docker compose)
+        - Docker (ghcr.io image)
+        - Local dev (npm run dev)
+        - Local production (npm run build && npm start)
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+      description: The release tag, image tag, or `git rev-parse --short HEAD`.
+      placeholder: v0.1.0
+    validations:
+      required: true
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Which part of the app?
+      options:
+        - Bookkeeping (transactions, recurring, vendors)
+        - Bank CSV import
+        - Receipt scanning (AI extraction)
+        - SA105 / personal tax
+        - Limited company (corporation tax, dividends, director's loan)
+        - What-if planner / salary-vs-dividend optimiser
+        - Deductions assistant (mileage, use of home)
+        - Akaunting migration
+        - Auth / login / sessions
+        - Setup, Docker, or configuration
+        - UI / theming
+        - Something else
+    validations:
+      required: true
+
+  - type: dropdown
+    id: tax-year
+    attributes:
+      label: Tax year involved
+      description: Leave as N/A if this isn't a tax calculation issue.
+      options:
+        - N/A
+        - 2025-26
+        - 2026-27
+        - 2027-28
+        - Earlier year
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: >
+        Relevant output from `docker compose logs quidly` or the dev server, plus
+        any browser console errors. Redact secrets.
+      render: shell
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      placeholder: |
+        Host OS: Debian 12
+        Browser: Firefox 141
+        Reverse proxy: Caddy
+        COOKIE_SECURE: unset
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before submitting
+      options:
+        - label: I searched existing issues and this isn't a duplicate
+          required: true
+        - label: I've removed any real financial or personal data from this report
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,15 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Question or setup help
+    url: https://github.com/WarlaxZ/quidly/discussions
+    about: >
+      Ask in Discussions rather than opening an issue — setup, Docker, and
+      "how do I record X" questions are answered there.
+  - name: Report a security vulnerability
+    url: https://github.com/WarlaxZ/quidly/security/advisories/new
+    about: Please report privately, not in a public issue.
+  - name: Official HMRC guidance
+    url: https://www.gov.uk/renting-out-a-property
+    about: >
+      Quidly produces estimates, not tax advice. For what you actually owe,
+      check HMRC or ask an accountant.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,65 @@
+name: Feature request
+description: Suggest something Quidly should do
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before writing this up, note two things that are **deliberately out of
+        scope**: multi-user / multi-tenant support (each install is single-user),
+        and tax regimes for countries other than the UK. Requests for either will
+        be closed — though forking is a perfectly good answer, and the AGPL is
+        there for that.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem are you hitting?
+      description: >
+        Describe the situation rather than the solution. "I have three properties
+        with different mortgage rates and can't see which is loss-making" is more
+        useful than "add a per-property P&L chart".
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What would you like Quidly to do?
+    validations:
+      required: true
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Which part of the app?
+      options:
+        - Bookkeeping (transactions, recurring, vendors)
+        - Bank CSV import
+        - Receipt scanning (AI extraction)
+        - SA105 / personal tax
+        - Limited company
+        - What-if planner / optimiser
+        - Deductions assistant
+        - Migration from other software
+        - Setup, Docker, or configuration
+        - UI / theming
+        - Something else
+    validations:
+      required: true
+
+  - type: textarea
+    id: workaround
+    attributes:
+      label: How are you working around it today?
+      description: Spreadsheet, another tool, manual calculation, not at all?
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before submitting
+      options:
+        - label: I searched existing issues and discussions for this idea
+          required: true
+        - label: This isn't multi-user support or a non-UK tax regime
+          required: true