Bring docs and license to sync

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,41 @@
+---
+name: Bug report
+about: Something isn't working as expected
+labels: bug
+---
+
+## What happened
+
+A clear description of the bug.
+
+## Expected behaviour
+
+What you expected to happen.
+
+## Steps to reproduce
+
+1.
+2.
+3.
+
+## Environment
+
+- beacon-web version / commit:
+- beacon-server version (backend):
+- Browser and version:
+- OS:
+- Deployment method (Docker image / `npm run dev`):
+
+## Screenshots
+
+If applicable, add screenshots to help explain the problem.
+
+## Console / network output
+
+```
+paste relevant browser console errors or failed requests here
+```
+
+## Additional context
+
+Any other context — region/IATA selected, packet type involved, etc.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,27 @@
+---
+name: Feature request
+about: Suggest a new feature or improvement
+labels: enhancement
+---
+
+## Summary
+
+A brief description of what you'd like to see.
+
+## Problem or motivation
+
+What problem does this solve, or what use case does it enable? If this is
+related to an existing issue or limitation, link it here.
+
+## Proposed solution
+
+How you'd like it to work — UI/UX, the view or component involved, and any
+backend data it would consume. As much detail as you have.
+
+## Alternatives considered
+
+Any other approaches you considered and why you ruled them out.
+
+## Additional context
+
+Mockups, screenshots, diagrams, or links to relevant MeshCore protocol docs.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,26 @@
+## What this PR does
+
+A clear description of the change and why it was made. Reference any related
+issues: `Closes #123` or `Related to #456`.
+
+## Type of change
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Refactor
+- [ ] Tests
+- [ ] Docs / config
+- [ ] Other:
+
+## Checklist
+
+- [ ] `npm run build` passes (the real typecheck)
+- [ ] `npm run lint` passes
+- [ ] `npm test` passes
+- [ ] New logic has tests (TDD for bugfixes and features)
+- [ ] Frontend types still match the beacon-server contract
+- [ ] I have read [CONTRIBUTING.md](../CONTRIBUTING.md)
+
+## Testing notes
+
+How did you test this? What should reviewers look for?

.github/workflows/ci.yml

@@ -0,0 +1,31 @@
+# Copyright 2026 Beacon Contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: CI
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Test
+        run: npm test

.github/workflows/codeql.yml

@@ -0,0 +1,31 @@
+# Copyright 2026 Beacon Contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: CodeQL
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+  schedule:
+    - cron: '0 8 * * 1'  # every Monday at 08:00 UTC
+
+jobs:
+  analyze:
+    if: false # remove after public release and enabled on repo
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3