Improve repo health and release workflow

[IgnazioDS]

Summary

• add contributor, security, issue, PR, and CODEOWNERS files
• fix the README quickstart so dependency installation happens before migrations and dev boot
• add a tag-driven GitHub release workflow and release docs
• add install support in the Makefile

Verification

• .venv/bin/ruff check app/ tests/ scripts/
• .venv/bin/mypy app/ --ignore-missing-imports
• .venv/bin/python -m build
• .venv/bin/pytest -q --tb=short (blocked locally because Docker daemon is not running, so Postgres could not be started)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9f13391311

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Gate manual releases on tag refs

With workflow_dispatch enabled, a maintainer can run this workflow from the default branch instead of a version tag. The softprops/action-gh-release action defaults tag_name to github.ref_name, so a manual run from main would try to create/update a release tagged main and attach artifacts built from that branch, bypassing the tag-driven release flow documented in docs/releasing.md. Add a tag input/guard or remove manual dispatch so manual runs cannot publish branch-named releases.

Useful? React with 👍 / 👎.