docs: add CONTRIBUTING.md guide for developer onboarding

[ayushsri-dev]

Summary

This PR adds a dedicated CONTRIBUTING.md guide to the repository root. It provides new and existing contributors with clear instructions for environment setup, multi-module project navigation, local quality verification, and pull request submissions across Arvio's Android app, web frontend, serverless auth backend, and Cloudflare workers.

---

Background & Motivation

While README.md covers end-user feature overviews and initial Android setup, the repository previously lacked unified documentation for contributor workflows, git/commit practices, and local pre-submission validation commands (unit tests, static analysis, type checking).

Adding CONTRIBUTING.md establishes a single source of truth for developer onboarding without cluttering user-facing product documentation.

---

What Changed

• Monorepo Directory Map: Added a high-level component map guiding contributors through app/, web/, iosApp/, netlify-auth-site/, resolver-worker/, supabase/, and docs/.
• Verified Build & Setup Commands: Documented local setup, debug variant compilation (play vs sideload), ADB deployment, and sub-project commands (web/, resolver-worker/, netlify-auth-site/).
• Code Quality & Pre-PR Verification: Documented exact commands for local unit testing (./gradlew :app:testPlayDebugUnitTest), Kotlin static analysis (./gradlew detekt), web linting (npm run lint), worker type-checking (npm run typecheck), and backend tests (npm test).
• Engineering Standards & Quality: Added expectations around code path inspection, focused PR scope, architectural alignment, behavior-oriented testing, and failure/edge-case handling.
• AI-Assisted Contribution Policy: Established that AI-assisted contributions are welcome but evaluated under the exact same engineering, security, maintainability, and testing standards as manual code, rejecting unreviewed or generated slop.
• CI Alignment: Detailed how local compilation (./gradlew assembleSideloadDebug) reproduces the automated GitHub Actions build check (.github/workflows/build-check.yml).
• Legal & Governance References: Linked directly to README.md for Content And Source Policy and local secret proxy details, PRIVACY.md for data policy, and LICENSE for Apache 2.0 terms.

---

Local Verification

• Verified all relative markdown links (README.md#local-configuration, README.md#content-and-source-policy, .github/workflows/build-check.yml, PRIVACY.md, LICENSE).
• Verified all Gradle tasks (assemblePlayDebug, assembleSideloadDebug, compilePlayDebugKotlin, assemblePlayRelease, assembleSideloadRelease, testPlayDebugUnitTest, detekt) against app/build.gradle.kts.
• Verified all NPM scripts (dev, build, start, lint, typecheck, test) against package.json manifests in web/, resolver-worker/, and netlify-auth-site/.
• Verified Markdown syntax, table of contents heading anchors, and code fence formatting.

---

Checklist

• My changes are focused solely on documentation (CONTRIBUTING.md).
• I have verified all CLI commands and file paths against actual repository files.
• No existing application code, Gradle settings, or CI workflows were modified.

Closes #477