docs: add missing governance files (CONTRIBUTING, SECURITY, CODE_OF_CONDUCT, LICENSE)

[Pigbibi]

Summary

• Adds four governance files that were entirely missing from this repo (confirmed via 404s): CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, LICENSE.
• CONTRIBUTING.md uses BinancePlatform's merged file as a style reference, but local verification commands are pulled from this repo's real CI (.github/workflows/ci.yml): ruff check . and pytest -q, not Binance's unittest discover command.
• SECURITY.md is scoped to what this repo actually does today: a bounded Alpaca paper/shadow execution gateway, currently only implementing the P5 SHADOW stage (no broker connectivity, no credentials, no order submission). I checked gh api repos/QuantStrategyLab/AlpacaPlatform/private-vulnerability-reporting and it returned {"enabled": false}, so the doc does not claim that reporting channel exists (unlike BinancePlatform's doc, which assumes it may be available). Maintainer contact is @Pigbibi, confirmed as the sole author/committer in this repo's git history.
• CODE_OF_CONDUCT.md matches BinancePlatform's structure (Our Standards / Project Scope / Reporting and Enforcement), with the Project Scope paragraph rewritten for AlpacaPlatform's actual purpose.
• LICENSE is the exact MIT text from BinancePlatform's merged LICENSE (same copyright line: Copyright (c) 2026 QuantStrategyLab).

Explicitly NOT done in this PR (and why)

• README.md was not touched. Confirmed it's already well-written prose with no ## QSL architecture role field-list block to clean up, per the task scope.
• README.zh-CN.md was not created, and no language-switcher link was added to either README. Reason: the task assumed README.md is in English (as it is in BinancePlatform, where README.zh-CN.md is the Chinese translation of an English-primary doc). That's not the case here — AlpacaPlatform's README.md is already written entirely in Chinese, and has been since the initial commit (verified via git log -p), authored directly by @Pigbibi, not a leftover from translation. Creating a "Chinese translation" of an already-Chinese file would just be a content duplicate, and adding a [English README](README.md) switcher link would mislabel README.md as English when it isn't. Rather than guess at a restructuring that the task explicitly told me not to do (touch/reorganize README.md), I'm flagging this for a maintainer decision — e.g. whether this repo should instead get an English translation (README.en.md?) with README.md staying canonical-Chinese, or whether the bilingual-pair convention simply doesn't apply to this repo. Happy to follow up once that's decided.

Test plan

• Confirmed via gh api repos/.../private-vulnerability-reporting that the channel is disabled, so SECURITY.md doesn't claim otherwise.
• Confirmed real CI commands by reading .github/workflows/ci.yml rather than assuming BinancePlatform's.
• Confirmed @Pigbibi is the actual repo author/committer via git log.
• Diffed LICENSE text against BinancePlatform's merged copy for an exact match.
• No code/build changes in this PR; nothing to run beyond existing CI (unaffected by doc-only changes).

🤖 Generated with Claude Code