chore(repo): add github hygiene, contributing and code of conduct

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,82 @@
+name: Bug report
+description: Something behaves incorrectly in WaveFlow for Android.
+labels: ["type: fix", "needs triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report this. A precise report gets fixed
+        much faster than a vague one.
+
+        **Security issue?** Don't file it here — see
+        [SECURITY.md](https://github.com/InstaZDLL/waveflow-android/blob/main/.github/SECURITY.md).
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: What you saw, and what you expected instead.
+      placeholder: |
+        Tapping a track in an album plays the whole library instead of the album.
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Numbered steps someone else can follow on a fresh install.
+      placeholder: |
+        1. Copy 3 albums to the device's Music folder
+        2. Open the Albums tab, tap the second album
+        3. Tap the third track
+        4. Open the full-screen player and skip forward
+    validations:
+      required: true
+
+  - type: input
+    id: android-version
+    attributes:
+      label: Android version
+      placeholder: "Android 15 (API 35)"
+    validations:
+      required: true
+
+  - type: input
+    id: device
+    attributes:
+      label: Device
+      description: Model, or the emulator you used.
+      placeholder: "Pixel 8 — or Pixel 8 API 35 emulator"
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: WaveFlow version or commit
+      placeholder: "main @ a1b2c3d"
+    validations:
+      required: true
+
+  - type: textarea
+    id: files
+    attributes:
+      label: The files involved
+      description: >-
+        For anything touching the library, playback, or artwork, this is
+        usually the decisive detail. Container and codec (m4a/AAC, mp3, FLAC…),
+        and which tags are present — an album splitting apart almost always
+        means a missing `albumArtist`. `mediainfo` or a desktop tag editor will
+        tell you.
+      placeholder: |
+        7 × m4a/AAC ripped from Apple Music. Tags: title, artist, album, artwork.
+        No albumArtist tag.
+
+  - type: textarea
+    id: extra
+    attributes:
+      label: Screenshots, screen recordings, or logs
+      description: >-
+        Drag files in directly. A `logcat` capture around the moment of the bug
+        helps a lot for crashes (`adb logcat` filtered on `app.waveflow`).

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,14 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security disclosure
+    url: https://github.com/InstaZDLL/waveflow-android/blob/main/.github/SECURITY.md
+    about: Report a vulnerability privately — please do not open a public issue.
+  - name: Question or setup help
+    url: https://github.com/InstaZDLL/WaveFlow/discussions/categories/q-a
+    about: "Ask in the main WaveFlow Q&A — 'how do I…', 'is this a bug or by design?'"
+  - name: Feature idea or UX proposal
+    url: https://github.com/InstaZDLL/WaveFlow/discussions/categories/ideas
+    about: Discuss the idea first; concrete feature requests can graduate to an issue afterward.
+  - name: Desktop or iOS issue
+    url: https://github.com/InstaZDLL/WaveFlow
+    about: This repository is the Android client only. Desktop and iOS live elsewhere.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,54 @@
+name: Feature request
+description: Propose a concrete change to WaveFlow for Android.
+labels: ["type: feat", "needs triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        If the idea is still taking shape, start a
+        [discussion](https://github.com/InstaZDLL/WaveFlow/discussions/categories/ideas)
+        instead — it can graduate to an issue once it's concrete.
+
+        Check the roadmap in the README first: playlists, search, and server
+        sync are already planned and don't need a new issue.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: What can't you do today? Describe the situation, not the solution.
+      placeholder: |
+        With ~2000 tracks, scrolling the Titres tab to reach anything past "M"
+        takes forever.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What you'd like instead
+      description: Be specific about the behaviour, not just the feature name.
+    validations:
+      required: true
+
+  - type: dropdown
+    id: parity
+    attributes:
+      label: Does this exist in another WaveFlow client?
+      description: >-
+        The three clients are meant to stay coherent. If desktop or iOS
+        already does it, matching their behaviour is usually the answer.
+      options:
+        - "No — Android-specific"
+        - "Yes, on desktop"
+        - "Yes, on iOS"
+        - "Yes, on both"
+        - "Not sure"
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives you considered
+      description: Including "do nothing" — say why it isn't enough.

.github/SECURITY.md

@@ -0,0 +1,58 @@
+# Security Policy
+
+Thank you for reporting security vulnerabilities responsibly before any public
+disclosure.
+
+## Supported Versions
+
+WaveFlow for Android does not have long-term version support yet. The main branch
+and the latest published release should be considered the only supported
+versions for security fixes.
+
+| Version                                           | Supported |
+| ------------------------------------------------- | --------- |
+| `main` / latest published release                 | Yes       |
+| Older versions, snapshots, and unmaintained forks | No        |
+
+## Reporting a Vulnerability
+
+**Do not open a public issue for security vulnerabilities.**
+
+Use one of these channels, depending on what is available on the public
+repository:
+
+1. **GitHub Security Advisories**: open the repository's _Security_ tab, then
+   choose _Report a vulnerability_. This is the recommended confidential
+   channel.
+2. Contact the maintainers privately if GitHub Security Advisories are not
+   available.
+
+Your report should include:
+
+- the affected version (or commit) and the Android version you ran it on;
+- a description of the vulnerability and its impact;
+- reproduction steps, and a sample file if the issue is triggered by one;
+- any suggested fix, if you have one.
+
+Please allow a reasonable delay for a fix before public disclosure.
+
+## Scope
+
+Things that are in scope for this repository:
+
+- reading and parsing audio files surfaced through `MediaStore` — malformed or
+  hostile tags, artwork, and container structures;
+- anything that could let a file or intent escape the app's scoped storage or
+  read/overwrite data outside the app's own storage;
+- exported components (activities, services, receivers, providers) and the
+  intents they accept;
+- the future WaveFlow server sync (signed URLs, credential handling) once it
+  lands.
+
+Out of scope:
+
+- vulnerabilities in Android itself or in vendor OS builds (report those to the
+  respective vendor);
+- issues that require a rooted device, a hostile ADB session, or physical access
+  to an unlocked phone;
+- the desktop and iOS clients — report those on their own repositories.

.github/dependabot.yml

@@ -0,0 +1,38 @@
+version: 2
+
+updates:
+  - package-ecosystem: gradle
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:15"
+      timezone: Europe/Zurich
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - gradle
+    commit-message:
+      prefix: chore
+    groups:
+      gradle-all:
+        patterns:
+          - "*"
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:15"
+      timezone: Europe/Zurich
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - github-actions
+    commit-message:
+      prefix: chore
+    groups:
+      github-actions-all:
+        patterns:
+          - "*"

.github/labeler.yml

@@ -0,0 +1,50 @@
+# Étiquettes basées sur les chemins, pour actions/labeler.
+# Les scopes reflètent le découpage du package app.waveflow.
+
+"scope: model":
+  - changed-files:
+      - any-glob-to-any-file:
+          - "app/src/main/java/app/waveflow/model/**"
+
+"scope: data":
+  - changed-files:
+      - any-glob-to-any-file:
+          - "app/src/main/java/app/waveflow/data/**"
+
+"scope: playback":
+  - changed-files:
+      - any-glob-to-any-file:
+          - "app/src/main/java/app/waveflow/playback/**"
+
+"scope: ui":
+  - changed-files:
+      - any-glob-to-any-file:
+          - "app/src/main/java/app/waveflow/ui/**"
+          - "app/src/main/res/**"
+
+"scope: project":
+  - changed-files:
+      - any-glob-to-any-file:
+          - "**/*.gradle.kts"
+          - "gradle/**"
+          - "gradle.properties"
+          - "settings.gradle.kts"
+          - "app/src/main/AndroidManifest.xml"
+
+"scope: tests":
+  - changed-files:
+      - any-glob-to-any-file:
+          - "app/src/test/**"
+          - "app/src/androidTest/**"
+
+"scope: ci":
+  - changed-files:
+      - any-glob-to-any-file:
+          - ".github/workflows/**"
+          - ".github/dependabot.yml"
+          - ".github/labeler.yml"
+
+"scope: docs":
+  - changed-files:
+      - any-glob-to-any-file:
+          - "**/*.md"

.github/pull_request_template.md

@@ -0,0 +1,52 @@
+<!--
+Thanks for the PR! A few quick reminders so review goes fast:
+
+1. PR title follows Conventional Commits with a kebab-case scope:
+     feat(player): gapless playback
+     fix(scanner): skip files with no audio track
+     perf(artwork): cache covers per album instead of per song
+   Scopes mirror the auto-labeler rules in .github/labeler.yml.
+
+2. Before opening, run locally:
+     ./gradlew testDebugUnitTest
+     ./gradlew lintDebug
+
+3. If you touched a cross-cutting pattern, update the README so future
+   readers (humans and Claude) stay in sync with the codebase.
+-->
+
+## Summary
+
+<!-- 1-3 bullets describing what changes and why. Focus on the why. -->
+
+-
+-
+
+## How I tested
+
+<!-- Concrete steps a reviewer could repeat. Skip "it builds" — that's CI's job.
+     For anything touching playback or scanning, say which files you tested
+     with: tags vary wildly in the wild, and most bugs here come from a
+     missing or malformed tag rather than from the code path itself. -->
+
+-
+-
+
+## Screenshots / clips
+
+<!-- For UI changes. Drag-and-drop directly into the PR description on the web UI.
+     Light and dark, please — the player tints itself from the artwork. -->
+
+## Checklist
+
+- [ ] Title uses Conventional Commits (`type(scope): subject`, kebab-case scope)
+- [ ] Builds and unit tests pass locally (`./gradlew testDebugUnitTest`)
+- [ ] UI changes checked in light *and* dark theme
+- [ ] Playback changes checked from the notification / lock-screen controls
+- [ ] Breaking change? Called out in the summary above
+
+## Linked issues
+
+<!-- Use "Closes #123" / "Refs #456" so GitHub auto-closes on merge. -->
+
+Closes #