E3: add community health files

The repository had no contributor-facing documentation or automation
config. Add the standard set:

- CHANGELOG.md (Keep a Changelog format, 0.1.0-0.1.4 plus Unreleased)
- CONTRIBUTING.md (build/test steps, change standards, PolyForm-NC note)
- SECURITY.md (private reporting, supported versions)
- CODE_OF_CONDUCT.md (Contributor Covenant 2.1)
- .github/ISSUE_TEMPLATE (bug report, feature request, config)
- .github/PULL_REQUEST_TEMPLATE.md
- .github/dependabot.yml (cargo, npm, pip, github-actions — the last
  keeps the D1 SHA pins current)
- .github/CODEOWNERS

.github/CODEOWNERS

@@ -0,0 +1,6 @@
+# Code owners for Wickra.
+#
+# The owner listed here is requested for review automatically on every pull
+# request. See https://docs.github.com/articles/about-code-owners.
+
+*       @kingchenc

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,39 @@
+---
+name: Bug report
+about: Report incorrect behaviour in Wickra
+title: "[bug] "
+labels: bug
+assignees: ""
+---
+
+## Description
+
+<!-- A clear description of what is wrong. -->
+
+## Reproduction
+
+<!-- Minimal code that reproduces the problem. -->
+
+```rust
+// or python / javascript
+```
+
+## Expected behaviour
+
+<!-- What you expected to happen, ideally with a reference value
+     (TA-Lib, pandas-ta, hand-computed). -->
+
+## Actual behaviour
+
+<!-- What happened instead. -->
+
+## Environment
+
+- Wickra version:
+- Language / binding: <!-- Rust crate / Python / Node / WASM -->
+- OS and architecture:
+- Rust / Python / Node version (if relevant):
+
+## Additional context
+
+<!-- Logs, screenshots, anything else. -->

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/kingchenc/wickra/security/advisories/new
+    about: Report security issues privately — do not open a public issue.
+  - name: Question or discussion
+    url: https://github.com/kingchenc/wickra/discussions
+    about: Ask usage questions and discuss ideas here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,31 @@
+---
+name: Feature request
+about: Suggest a new indicator or capability for Wickra
+title: "[feature] "
+labels: enhancement
+assignees: ""
+---
+
+## Problem
+
+<!-- What are you trying to do that Wickra cannot do today? -->
+
+## Proposed solution
+
+<!-- For a new indicator: its name, formula, and the standard parameters.
+     Link a reference implementation (TA-Lib, pandas-ta) if one exists. -->
+
+## Alternatives considered
+
+<!-- Other approaches and why they fall short. -->
+
+## Scope
+
+- [ ] Affects the Rust core
+- [ ] Should be exposed in the Python binding
+- [ ] Should be exposed in the Node binding
+- [ ] Should be exposed in the WASM binding
+
+## Additional context
+
+<!-- Anything else that helps. -->

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,33 @@
+<!-- Thanks for contributing to Wickra. Please fill in the sections below. -->
+
+## Summary
+
+<!-- What does this PR change, and why? -->
+
+## Related issue
+
+<!-- e.g. Closes #123 -->
+
+## Type of change
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Indicator addition / change
+- [ ] Documentation
+- [ ] CI / build / tooling
+
+## Checklist
+
+- [ ] `cargo fmt --all --check` is clean.
+- [ ] `cargo clippy --workspace --all-targets -- -D warnings` is clean.
+- [ ] `cargo test --workspace` passes.
+- [ ] New behaviour has tests; bug fixes have a regression test.
+- [ ] Public API changes are mirrored in the Python / Node / WASM bindings
+      and their type stubs (if applicable).
+- [ ] Documentation under `docs/wiki/` and the `README.md` is updated
+      (if applicable).
+- [ ] An entry was added under `## [Unreleased]` in `CHANGELOG.md`.
+
+## Notes for reviewers
+
+<!-- Anything that needs extra attention, trade-offs, follow-ups. -->

.github/dependabot.yml

@@ -0,0 +1,38 @@
+version: 2
+updates:
+  # Rust workspace (root Cargo.toml + all member crates).
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: "deps(cargo)"
+
+  # Node binding npm dependencies.
+  - package-ecosystem: npm
+    directory: "/bindings/node"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: "deps(npm)"
+
+  # Python binding pip dependencies.
+  - package-ecosystem: pip
+    directory: "/bindings/python"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: "deps(pip)"
+
+  # GitHub Actions — keeps the SHA-pinned actions current (Dependabot reads
+  # the version comment after each pinned SHA and bumps both together).
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: "deps(actions)"