Polish OpenCompress for reliability, contributors and discoverability

[SLP-DEV1]

Summary

This PR turns OpenCompress from a release-style repository into a cleaner public open-source project while fixing several real correctness and reliability issues.

Runtime fixes

• make start.bat actually work on a fresh clone by installing dependencies and building dist/ before production start
• reject invalid job IDs instead of sanitizing them into potentially dangerous paths
• prevent invalid DELETE job IDs from resolving to the entire jobs directory
• fix target-size compression when preferred quality is below 35
• stream preview/download files instead of loading them into memory again
• add explicit upload errors, validated numeric environment settings and external API timeouts
• require HTTPS result URLs from reSmush.it
• fix duplicate-filename before/after preview selection
• enforce the 250-file batch limit in the UI and add keyboard access to the upload zone

Repository polish

• rebuild README around a clear local-first value proposition, quick start, badges, privacy modes and shop workflows
• add CONTRIBUTING.md and SECURITY.md
• add bug/feature issue forms and a pull request template
• add Dependabot configuration
• harden CI with least-privilege permissions, concurrency cancellation, timeout, explicit Node support and a server syntax check
• align .env.example with the actual repository and new timeout setting
• remove leftover placeholder wording from the repository preview artwork

Validation

• ✅ npm ci
• ✅ node --check server/index.mjs
• ✅ npm run typecheck:strict
• ✅ npm run build

GitHub Actions run #11 passed on the final PR head.