Fix async database installation and document engineering boundaries

[Jemade]

Problem and resulting behavior

Reviewers needed a consistent path from product claims to setup instructions, implementation boundaries and actual verification. The repository now documents that path and checks tracked-file hygiene automatically.

Changes

• Engineering notes with project-specific data flow, source locations, verification commands and limitations.
• Contributor and security instructions, issue/PR forms, and ignored local runtime/private files.
• CI checks for required documentation, accidentally tracked runtime files and selected credential patterns. This is not a complete security or history audit.
• A review checklist that leaves independent review, real users, target-environment validation and owner understanding unchecked until evidence exists.
• Prepared repository About values; GitHub settings were not edited by these tools.

Also declares SQLAlchemy's asyncio extra to resolve the existing missing-greenlet CI failure. All 7 backend tests passed locally with proxy variables removed.

Validation

The new hygiene check passes locally. Existing licenses and third-party notices are preserved; no new reuse rights are granted where ownership/licensing decisions are outstanding. CI must pass before merge. Documentation-only changes do not establish production readiness or measured performance.

Review focus

Check that setup commands, limitations and claims match source behavior. Review each application job separately from the documentation check.