docs: add code of conduct, contributing guide and CODEOWNERS

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @PhilippTheServer @maltonoloco

.github/workflows/ci.yml

@@ -31,6 +31,9 @@ jobs:
             if (!/Apache License\s+Version 2\.0/.test(fs.readFileSync("LICENSE", "utf8"))) throw new Error("LICENSE is not Apache-2.0");
           '
 
+      - name: Community files
+        run: test -f CODE_OF_CONDUCT.md && test -f CONTRIBUTING.md && test -f .github/CODEOWNERS
+
       - name: Install dependencies
         run: npm ci
 

CODE_OF_CONDUCT.md

@@ -0,0 +1,72 @@
+# Code of Conduct
+
+OpenTaberna is built by people who care about getting things right, and who sometimes
+get loud when they don't. That is fine. What is not fine is taking it out on each other.
+
+## The one rule that makes this project different
+
+**Swear at code all you like. Never swear at people.**
+
+Allowed:
+
+- "This function is a goddamn mess."
+- "Who the hell thought a 400-line regex was a good idea? Let's rip it out."
+- "This build is fucked again."
+
+Not allowed:
+
+- "You're an idiot for writing this."
+- "Only a moron would ship this."
+- Anything aimed at a person's intelligence, competence, identity or worth, whether it
+  contains swear words or not.
+
+Criticise the work, never the person who made it. Assume the author had a reason, ask
+what it was, and then say how to make it better. If you would be embarrassed to say it to
+their face in a room with everyone else present, don't write it.
+
+## What we expect
+
+- Be respectful of differing viewpoints and experience levels.
+- Give feedback that is concrete and actionable, and take feedback the same way.
+- Own your mistakes, apologise to the people affected, and learn from it.
+- Focus on what is best for the project and the people using it.
+
+## What we do not tolerate
+
+- Insults, slurs or demeaning remarks about anyone, including profanity directed at a
+  person.
+- Harassment, in public or in private, including continued contact after being asked to
+  stop.
+- Discrimination based on age, body size, disability, ethnicity, sex characteristics,
+  gender identity and expression, level of experience, education, socio-economic status,
+  nationality, personal appearance, race, religion, or sexual identity and orientation.
+- Sexualised language or imagery, and unwelcome sexual attention.
+- Publishing others' private information without their explicit permission.
+- Trolling, and deliberately derailing discussions.
+
+## Scope
+
+This applies in every OpenTaberna space — repositories, issues, pull requests, reviews,
+chats — and when you represent the project elsewhere.
+
+## Reporting
+
+Report anything that breaks this code to the maintainers, @PhilippTheServer or
+@maltonoloco. Reports are handled privately, and the reporter's identity is protected.
+
+## Enforcement
+
+Maintainers decide what counts as a breach and respond in proportion:
+
+1. **Correction** — a private note explaining what was wrong. A public apology may be
+   requested.
+2. **Warning** — a formal warning with consequences for repeat behaviour.
+3. **Temporary ban** — no interaction with the project for a set period.
+4. **Permanent ban** — for repeated or severe breaches, including harassment.
+
+Maintainers may remove or edit comments, commits, code, issues and other contributions
+that break this code.
+
+## Attribution
+
+Adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1.

CONTRIBUTING.md

@@ -0,0 +1,36 @@
+# Contributing
+
+Thanks for helping out. Read the [Code of Conduct](CODE_OF_CONDUCT.md) first — swearing
+about code is fine, swearing at people is not.
+
+## How a change gets in
+
+`main` is protected. Only the maintainers, @PhilippTheServer and @maltonoloco, can push
+to it directly. Everyone else goes through a pull request:
+
+1. **Open an issue** describing the behaviour you expect once it is solved. Small fixes
+   too — it is where the discussion lives.
+2. **Branch** from `main` (or fork, if you have no write access).
+3. **Commit and push** your branch.
+4. **Open a pull request** against `main` and link the issue with `Closes #N` in the
+   body.
+5. **CI must pass.** These checks are required before the PR can be merged:
+   - `Test and build`
+6. **A maintainer must approve.** Every file is owned by @PhilippTheServer and
+   @maltonoloco (see [.github/CODEOWNERS](.github/CODEOWNERS)); one of them has to
+   review and approve. New commits after an approval need a fresh approval.
+7. **Squash merge.** The PR lands as a single commit on `main`; delete the branch
+   afterwards.
+
+## Before you open the PR
+
+Run the same checks locally so CI has no surprises:
+
+```sh
+npm ci
+npx ng test --watch=false
+npx ng build --configuration production
+```
+
+Update the docs in the same PR as the change, not afterwards, and add a test that would
+fail if your fix regressed.

README.md

@@ -24,6 +24,10 @@ Product images come from the API as paths relative to its root (`/v1/items/{uuid
 
 The item-store inventory fields are displayed as catalogue metadata. The checkout endpoint is responsible for validating and reserving authoritative stock from the separate inventory service.
 
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) and the [Code of Conduct](CODE_OF_CONDUCT.md).
+
 ## Licence
 
 Apache License 2.0 — see [LICENSE](LICENSE).