chore(github): add issue + PR templates

- bug_report.yml: structured fields for version, deployment, repro
  steps, logs; routes security to SECURITY.md
- feature_request.yml: problem-then-proposal template, surface
  multi-select aligned with the app's actual touch points
- config.yml: disables blank issues, points usage questions to docs
  + Discussions, points security to private advisories
- PULL_REQUEST_TEMPLATE.md: reminds the contributor to target develop
  (not main), checklist mirrors local CI, no-PII reminder

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,77 @@
+name: Bug report
+description: Something is broken or behaves unexpectedly in HealthLog.
+title: "[Bug] "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a bug. Before submitting, please:
+
+        - Check that the issue isn't already in the [issue tracker](https://github.com/MBombeck/HealthLog/issues).
+        - For security issues, do **not** open a public issue — see [SECURITY.md](https://github.com/MBombeck/HealthLog/blob/main/SECURITY.md).
+        - For usage / configuration questions, the [docs](https://docs.healthlog.dev) are usually faster.
+  - type: input
+    id: version
+    attributes:
+      label: HealthLog version
+      description: Output of `/api/version` or the tag of the GHCR image you're running.
+      placeholder: "1.4.19"
+    validations:
+      required: true
+  - type: dropdown
+    id: deployment
+    attributes:
+      label: Deployment type
+      options:
+        - Self-hosted (Docker)
+        - Self-hosted (manual)
+        - Local development
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear, concise description of the bug.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What did you expect to happen instead?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Numbered steps the maintainer can follow to see the bug locally.
+      placeholder: |
+        1. Go to '...'
+        2. Click on '...'
+        3. See error
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs / screenshots
+      description: Paste any relevant log output (redact secrets) or attach screenshots. Wide-event logs from `/admin/app-logs` are useful.
+      render: shell
+  - type: input
+    id: browser
+    attributes:
+      label: Browser / OS (if applicable)
+      placeholder: "Firefox 142 on macOS 14.5 / Chrome 128 on Android 14"
+  - type: checkboxes
+    id: terms
+    attributes:
+      label: Pre-flight checks
+      options:
+        - label: I confirmed this is not a duplicate of an existing issue.
+          required: true
+        - label: I redacted any secrets, tokens, or personal data from logs.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Documentation
+    url: https://docs.healthlog.dev
+    about: Setup, configuration, and feature documentation. Most usage questions are answered here.
+  - name: Security advisory
+    url: https://github.com/MBombeck/HealthLog/security/advisories/new
+    about: Report a security vulnerability privately. See SECURITY.md for the full policy.
+  - name: Discussions
+    url: https://github.com/MBombeck/HealthLog/discussions
+    about: Open-ended questions, ideas you want to brainstorm, and "is this the right approach?" threads.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,60 @@
+name: Feature request
+description: Suggest a new feature, integration, or enhancement.
+title: "[Feature] "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Feature ideas welcome. HealthLog is a personal-health PWA — the bar for inclusion is high (privacy-first, offline-capable, self-hostable). Use this template to propose something concrete; for open-ended discussion, prefer a [Discussion](https://github.com/MBombeck/HealthLog/discussions) thread.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What user problem does this feature solve? "I want to track X but..." is a great opening.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: How would the feature work from the user's perspective? Sketches / mocks welcome.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: What workarounds exist today, and why are they insufficient?
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Affected surface
+      multiple: true
+      options:
+        - Web (PWA)
+        - iOS app (v1.5+)
+        - API
+        - Admin
+        - Notifications
+        - AI Insights
+        - Withings integration
+        - moodLog integration
+        - Self-hosting / Docker
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Anything else the maintainer should know — links, related issues, prior art.
+  - type: checkboxes
+    id: terms
+    attributes:
+      label: Pre-flight checks
+      options:
+        - label: I confirmed this is not a duplicate of an existing feature request.
+          required: true
+        - label: I'm proposing a feature, not asking a usage question (those go to Discussions or the docs).
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,44 @@
+<!-- Thanks for opening a PR. Please fill in the sections below. -->
+
+## Summary
+
+<!-- 1-3 sentences: what changed and why. -->
+
+## Type of change
+
+<!-- Tick all that apply. -->
+
+- [ ] Bug fix (non-breaking change that fixes an issue)
+- [ ] New feature (non-breaking change that adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to change)
+- [ ] Documentation only
+- [ ] Test / CI / tooling
+- [ ] Refactor (no functional change)
+
+## Test plan
+
+<!-- How was this verified? Manual steps, automated tests, screenshots for UI changes. -->
+
+- [ ]
+- [ ]
+
+## Screenshots (UI changes only)
+
+<!-- Drop before/after screenshots or a short screen recording. Mobile + desktop where relevant. -->
+
+## Checklist
+
+- [ ] Targets the `develop` branch (not `main` — see [CONTRIBUTING.md](../CONTRIBUTING.md))
+- [ ] `pnpm typecheck` passes locally
+- [ ] `pnpm lint` passes locally
+- [ ] `pnpm test` passes locally
+- [ ] `pnpm format:check` passes locally
+- [ ] `pnpm build` passes locally
+- [ ] User-facing strings go through `t("key")` with both `messages/en.json` and `messages/de.json` updated
+- [ ] No secrets, personal data, or maintainer-name references in committed files
+- [ ] Updated `CHANGELOG.md` if user-visible
+- [ ] Updated `docs/audit/` or `docs.healthlog.dev` if behavior or self-hosting docs change
+
+## Linked issues
+
+<!-- Closes #123, Refs #456 -->