README for developers and CI; comparison page; security and contributing docs

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,60 @@
+name: Bug report
+description: Something in HomeCloud (server, CLI, console, install) does not work as documented.
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting. If an AWS tool (AWS CLI, SDK, Terraform) fails because an operation or option is missing, use the **AWS compatibility gap** form instead.
+        **Security problems:** do not file them here; see [SECURITY.md](https://github.com/solinode/homecloud/blob/main/SECURITY.md).
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+      description: What you did, what you expected, and what happened instead.
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: Commands, a small Terraform file or script, or console clicks. The smaller the better.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs and error output
+      description: The error message, and the relevant lines of the `homecloud serve` output. Remove secrets and access keys.
+      render: text
+  - type: input
+    id: version
+    attributes:
+      label: HomeCloud version
+      description: Output of `homecloud version`.
+    validations:
+      required: true
+  - type: dropdown
+    id: docker
+    attributes:
+      label: Docker
+      options:
+        - Docker Engine on Linux
+        - Docker Desktop (macOS)
+        - Docker Desktop (Windows)
+        - OrbStack
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: os
+    attributes:
+      label: Operating system and architecture
+      placeholder: e.g. Ubuntu 24.04 amd64, macOS 15 arm64
+  - type: textarea
+    id: doctor
+    attributes:
+      label: homecloud doctor
+      description: Output of `homecloud doctor`, if relevant.
+      render: text

.github/ISSUE_TEMPLATE/compatibility_gap.yml

@@ -0,0 +1,76 @@
+name: AWS compatibility gap
+description: An AWS CLI command, SDK call, Terraform resource or CloudFormation template that works on AWS but not on HomeCloud.
+labels: ["aws-api"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        These reports drive what gets implemented next, so thank you. Check [docs/aws-compat.md](https://github.com/solinode/homecloud/blob/main/docs/aws-compat.md) first: it lists what each service supports and what is known to be missing.
+  - type: input
+    id: service
+    attributes:
+      label: AWS service and operation
+      placeholder: e.g. SQS ListQueueTags, aws_dynamodb_table, AWS::ECS::Cluster
+    validations:
+      required: true
+  - type: dropdown
+    id: tool
+    attributes:
+      label: Tool
+      options:
+        - AWS CLI
+        - boto3 / botocore
+        - AWS SDK for JavaScript
+        - AWS SDK for Go
+        - AWS SDK for Java
+        - Other AWS SDK
+        - Terraform / OpenTofu
+        - AWS CDK
+        - CloudFormation
+        - Pulumi
+        - Other
+      multiple: true
+    validations:
+      required: true
+  - type: input
+    id: tool-version
+    attributes:
+      label: Tool version
+      placeholder: e.g. aws-cli/2.17.0, hashicorp/aws 5.60.0
+  - type: textarea
+    id: repro
+    attributes:
+      label: Request that fails
+      description: The smallest command, code or configuration that shows it.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: What HomeCloud returns
+      description: The error (e.g. `UnknownOperationException`, `InvalidAction`) or the wrong output. For Terraform, `TF_LOG=debug` output around the failing call helps.
+      render: text
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What AWS does
+      description: The expected response or behavior, with a link to the AWS API reference if you have one.
+  - type: textarea
+    id: why
+    attributes:
+      label: How it blocks you
+      description: Is there a workaround? Is this one call in a larger stack (which)?
+  - type: input
+    id: version
+    attributes:
+      label: HomeCloud version
+      description: Output of `homecloud version`.
+  - type: checkboxes
+    id: contribute
+    attributes:
+      label: Contributing
+      options:
+        - label: I would like to implement this (see CONTRIBUTING.md, "Making changes").

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/solinode/homecloud/security/advisories/new
+    about: Please report security problems privately, not as public issues.
+  - name: Questions and ideas
+    url: https://github.com/solinode/homecloud/discussions
+    about: Ask how to do something or discuss a larger idea.
+  - name: Discord
+    url: https://discord.gg/pemra9uaC9
+    about: Chat with other users and the maintainers.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,47 @@
+name: Feature request
+description: A new service, console feature, CLI command or improvement.
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        For a missing AWS operation or option, the **AWS compatibility gap** form is quicker. Bigger ideas can start in [Discussions](https://github.com/solinode/homecloud/discussions).
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What are you trying to do, and what gets in the way today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: What you would like HomeCloud to do. If it mirrors an AWS feature, name it and link the AWS docs.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives and workarounds
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - AWS API compatibility
+        - Console
+        - homecloud CLI
+        - Compute (EC2, ECS, Lambda)
+        - Networking (VPC, security groups, DNS, load balancers)
+        - Storage and databases
+        - Install, upgrade, operations
+        - Documentation
+        - Other
+      multiple: true
+  - type: checkboxes
+    id: contribute
+    attributes:
+      label: Contributing
+      options:
+        - label: I would like to work on this.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,19 @@
+## What and why
+
+<!-- What does this change, and why? Link the issue: "Fixes #123". -->
+
+## How it was tested
+
+<!-- Which tests ran (and did not skip)? For AWS operations: the AWS CLI / boto3 test in the service's aws_test.go.
+     Docker-backed tests skip without a reachable Docker; on macOS set DOCKER_HOST (see CONTRIBUTING.md). -->
+
+- [ ] `make test` (or the affected packages: `go test ./internal/svc/<name>/`)
+- [ ] AWS CLI / boto3 compatibility tests ran (`HC_TEST_PYTHON` set, `aws` on `PATH`)
+- [ ] Docker-backed tests ran (not skipped), if the change touches containers
+- [ ] Console: `npx tsc --noEmit && npm run build`, if the change touches `console/`
+
+## Checklist
+
+- [ ] New routes and AWS operations authorize with the right IAM action and resource ARN
+- [ ] Docs updated: `docs/aws-compat.md` (operations, differences from AWS), `docs/architecture.md`, `docs/api.md` (`python3 scripts/gen-api-docs.py`) as needed
+- [ ] A line under "Unreleased" in `CHANGELOG.md` for user-visible changes