Stream D: Security hardening — 10 fixes from QA review

- SEC-05: Fail fast if SECRET_KEY is default 'change-me-in-production'
- SEC-06: CORS allow_credentials=False (Bearer tokens don't need it)
- SEC-08: Input validation on auth schemas (min/max length, username pattern)
- SEC-10: .dockerignore files (root, backend, mcp-connector)
- SEC-11: Hardcode ALGORITHM='HS256' as constant, remove from settings
- CQ-01: Gate crawl scheduler on CRAWL_ENABLED env var (default false)
- OS-02: CONTRIBUTING.md
- OS-03: CHANGELOG.md with v1.0.0 entry
- setup.ps1: Add API_TOKEN generation (Windows parity with setup.sh)

CONTRIBUTING.md

@@ -0,0 +1,31 @@
+# Contributing to Diligence
+
+Thanks for your interest in contributing!
+
+## How to contribute
+
+1. **Open an issue** to discuss the change before starting work
+2. **Fork the repo** and create a branch from `main`
+3. **Test locally**: `docker compose up -d` and verify all 4 containers start healthy
+4. **Submit a PR** with a clear description of what changed and why
+
+## Development setup
+
+```bash
+git clone https://github.com/DiligenceWorks/Diligence.git
+cd Diligence
+./setup.sh          # Mac/Linux
+docker compose up -d
+```
+
+Open http://localhost and register. First user gets admin automatically.
+
+## Code style
+
+- Backend: Python 3.11+, FastAPI, async/await, type hints
+- Frontend: React with hooks, no class components
+- CSS: use CSS variables from `index.css`, never hardcode colors
+
+## Questions?
+
+Open a GitHub Discussion or reach out at hello@diligenceworks.online.