docs(contributing): expand with setup, conventions, and PR guidelines

CONTRIBUTING.md

@@ -1,3 +1,57 @@
-This is a one-person project maintained in spare time. Bug reports and patches are welcome, but there are no guarantees around response time, acceptance, or ongoing support.
+# Contributing to TinyWeb Forum
 
-Code was generated by LLMs. If you submit a PR, assume I'll review it the same way — I'll look for whether it works and whether it fits, not whether it's idiomatic or perfectly styled.
+Thanks for helping. TinyWeb Forum is a decentralized, trust-gated forum plugin
+for the TinyWeb search engine, built on the Reticulum mesh.
+
+## Before you start
+
+- Open an issue first for anything beyond a small bug fix.
+- One change per pull request. Keep it focused and reviewable.
+- The forum uses gossip-based trust — PRs that undermine this model are out of scope.
+
+## Setup
+
+```bash
+git clone https://codeberg.org/tinyweb/tinyweb-forum.git
+pip install -e .
+```
+
+Requires TinyWeb core to be running. Enable the forum in TinyWeb settings.
+
+## What fits
+
+- Bug fixes, sync reliability, and mesh resilience
+- Trust and moderation improvements
+- Documentation and test coverage
+- Edge case handling and error recovery
+
+## What doesn't fit
+
+- Centralized moderation or admin panels
+- Dependencies that assume internet connectivity
+- Features breaking local-first or gossip-based operation
+
+## Pull requests
+
+- Target `main`.
+- Describe what changed and why.
+- Include test output or manual test steps.
+- Use [Conventional Commits](https://www.conventionalcommits.org):
+  `fix(sync): ...`, `feat(trust): ...`, `docs(readme): ...`
+
+LLM-generated PRs should be preceded by an issue.
+
+## Code conventions
+
+- No JavaScript or CSS frameworks
+- No hardcoded paths, domains, IPs, or destination hashes
+- No Unicode emoji — use HTML entities or plain text
+
+## Issue reports
+
+Include: TinyWeb version, install method, OS, steps to reproduce.
+For mesh issues: interface type, RNS destination hash if relevant.
+
+## Security
+
+See [SECURITY.md](SECURITY.md). Report vulnerabilities privately.