docs: reorder architecture-role block, add SECURITY/CODE_OF_CONDUCT

[Pigbibi]

Summary

• Move the "QSL architecture role" field-list block in README.md and README.zh-CN.md to come after the human-readable "What this repository is" intro section (was positioned before it). Pure reordering — content of the block and the intro section is unchanged; verified via diff that only position moved.
• Add SECURITY.md and CODE_OF_CONDUCT.md, which did not exist in this repo (confirmed 404 before this change). Content is tailored to what this repo actually does — an A-share factor-snapshot/artifact/evidence pipeline that does not place broker orders or store broker credentials — rather than copying trading-platform-specific language from other QSL repos. Checked private-vulnerability-reporting via the GitHub API (currently disabled for this repo) before wording the reporting channel as conditional rather than claiming it's active.
• CONTRIBUTING.md already existed and was already fine; left untouched.
• No other instances of the role-block-ordering pattern or "中文摘要" boilerplate were found elsewhere in this repo's README/CONTRIBUTING/SECURITY/CODE_OF_CONDUCT files, so no incidental fixes were needed.

Test plan

• git diff on README.md / README.zh-CN.md confirms only the block's position changed (sorted non-blank lines are identical between old and new versions).
• Confirmed SECURITY.md/CODE_OF_CONDUCT.md were previously 404 (not present in repo tree).
• Confirmed via gh api repos/QuantStrategyLab/CnEquitySnapshotPipelines/private-vulnerability-reporting that private vulnerability reporting is currently disabled; SECURITY.md wording reflects this conditionally rather than asserting it's an active channel.
• No code, workflow, or other doc files touched.

🤖 Generated with Claude Code