docs: README, changelog, contributing, security, deployment, operations, CI

CONTRIBUTING.md

@@ -0,0 +1,41 @@
+# Contributing
+
+## Development setup
+
+Clone the repo and set up a venv:
+
+    git clone https://git.ankh-morpork.discworld.network/laurence/dns-traefik-sync.git
+    cd dns-traefik-sync
+    python3 -m venv venv
+    source venv/bin/activate
+
+No external Python dependencies - stdlib only by design.
+
+## Testing locally
+
+Set environment variables to point at a test Traefik instance and DNS zone, then run:
+
+    python3 dns_sync.py
+
+You will need a valid Kerberos ticket or keytab. For dry-run testing without a real Samba DC,
+set DNS_SERVER to a non-existent host and observe that nsupdate errors are caught and logged cleanly.
+
+## Building the image
+
+    docker build -t dns-traefik-sync:dev .
+
+## Releases
+
+Tag with vMAJOR.MINOR.PATCH - the Gitea Actions workflow will build and push automatically:
+
+    git tag v1.0.1
+    git push origin v1.0.1
+
+Update CHANGELOG.md before tagging.
+
+## Code style
+
+- stdlib only, no third-party dependencies
+- All configuration via environment variables
+- Errors caught per-hostname, never crash the whole sync cycle
+- Log every DNS write at INFO level