Prepare TimeClock Pro for public open-source release

[drumhead39]

Summary

Prepares TimeClock Pro for a future public GPLv3 open-source release while keeping the repository private during review.

What changed

• adds GPLv3 licensing, contribution guidance, a code of conduct, changelog, issue forms, and a pull request template
• replaces clinic-specific icons and branding with a generic TimeClock Pro SVG icon
• completes the fresh-install MySQL/MariaDB schema, including provider-production tables and default settings
• adds a CLI command for creating the first administrator
• improves README installation, security, update, and testing instructions
• adds login throttling, session and CSRF rotation, CSRF-protected logout, stricter security headers, and protected storage
• restricts the all-employee timecard overview to administrators
• validates submitted dates, times, PTO values, provider rates, and identifiers
• adds regression and repository-hygiene checks to GitHub Actions
• removes generated and clinic-branded binary assets from the public-release tree

Impact

The public-release branch is intended to remain private until automated checks pass and repository settings are reviewed. The current main branch is unchanged.

Existing production installations should use the SQL migrations rather than re-importing database/schema.sql.

Validation

• all 50 PHP files parsed successfully with an independent PHP parser
• all 5 YAML files parsed successfully
• the MySQL schema parsed successfully
• sensitive runtime files and business-specific identifiers were scanned and not found
• GitHub Actions will run PHP syntax, regression, and repository-hygiene checks on this pull request