docs: expand pull request template for public contributors (#1837)

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,15 +1,41 @@
-## What does this PR do?
+<!--
+Thanks for contributing to Sencho.
 
-<!-- Brief description of the change -->
+Keep this PR to one concern. Do not include secrets, tokens, credentials,
+private keys, or real hostnames/IPs in the diff, commits, or this description.
+Report security issues privately (see https://github.com/studio-saelix/sencho/blob/main/SECURITY.md),
+not in a public pull request.
+-->
 
-## Related Issue
+## Summary
 
-<!-- Link to issue: Closes #123 -->
+<!-- What changed, and why. A few sentences is enough. -->
+
+## Type of change
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Documentation
+- [ ] Tests
+- [ ] Refactor, chore, or CI
+- [ ] Breaking change
+
+## Related issue
+
+<!-- `Closes #123` if this fixes an issue. Optional, but preferred. -->
+
+## Testing performed
+
+<!--
+What you ran or clicked, and what you observed.
+Commands, UI paths, or both. CI passing is not a substitute for this.
+-->
 
 ## Checklist
 
-- [ ] Tests added/updated (if applicable)
-- [ ] Documentation updated (if applicable)
-- [ ] ESLint passes (`npm run lint` in backend/ and frontend/)
-- [ ] Commit messages follow Conventional Commits
-- [ ] Commit message follows Conventional Commits (the CHANGELOG entry is generated from the commit subject by release-please; do not edit `CHANGELOG.md` directly).
+- [ ] CLA check must pass ([CLA.md](https://github.com/studio-saelix/sencho/blob/main/CLA.md); you will be prompted on your first PR)
+- [ ] Tests added or updated, or this change does not need them
+- [ ] Docs updated if user-facing behavior, labels, or defaults changed
+- [ ] Lint and typecheck pass locally (`npm run lint` and `npx tsc --noEmit` in `backend/` and/or `frontend/` as applicable)
+- [ ] Commit messages and the PR title follow [Conventional Commits](https://www.conventionalcommits.org/) (the CHANGELOG line comes from the subject; do not edit `CHANGELOG.md`)
+- [ ] This PR stays on one concern and contains no secrets

CONTRIBUTING.md

@@ -62,11 +62,14 @@ Sencho and Studio Saelix names and logos are trademarks. AGPLv3 does not grant t
 ## Pull Request Process
 
 - All PRs target `main`
+- Fill in the pull request template (summary, type of change, testing performed).
+- The CLA Assistant check must pass. First-time contributors are prompted to sign [CLA.md](CLA.md).
 - Ensure CI passes before requesting review
 - Use [Conventional Commits](https://www.conventionalcommits.org/) for commit messages
 - Update documentation if your change affects user-facing behavior
 - Add tests for new functionality
 - Keep PRs focused: one feature or fix per PR
+- Do not include secrets, tokens, credentials, or real hostnames/IPs in the diff, commits, or PR description.
 - Do not edit `CHANGELOG.md` directly. It is generated from conventional-commit subjects by release-please. If a user-facing change needs more context, enrich the auto-opened Release PR description before merging.
 
 ## Reporting Bugs