docs(contributing): add lightweight PR flow and CODEOWNERS review gate

[dzhhem]

What

Scale the contribution flow to the size and risk of a change, and enforce that split automatically.

• CONTRIBUTING.md — new Lightweight Changes section (lightweight vs full flow, gated on scope/risk, not commit count). Small, low-risk changes skip the tracking issue, the full PR template, and the blocking approval; a lightweight PR is self-merged once CI is green, while a full-flow PR still needs a reviewer's approval. Documents how the split is enforced.
• .github/PULL_REQUEST_TEMPLATE.md — the short What / Why / Testing form lives inline in an HTML comment at the top: a lightweight PR deletes the full template and uses it; a full PR leaves the comment (it stays hidden) and fills the sections below.
• .github/CODEOWNERS — new file. With branch protection set to 0 baseline approvals + Require review from Code Owners, a PR that touches a sensitive path (database schema/migrations, any .env*.example, auth/middleware code, packages/types, CI workflows, deploy config, or the CODEOWNERS file itself) requires an owner's approval to merge; a PR that touches none can be self-merged.

Why

Issue-per-change plus the full template and a mandatory approval is heavyweight for trivial work, and waiting on a second pair of eyes for a typo just stalls it. Gating on scope and risk rather than commit count keeps the process honest — features, schema, public API, and security changes still take the full flow and still need an approval, regardless of size. CODEOWNERS makes that gate automatic and path-based instead of relying on everyone classifying their own PR correctly: the risky paths are listed once, and GitHub blocks self-merge exactly there.

Testing

n/a — docs + config only, no code paths changed.