docs: adds contributing guide

CONTRIBUTING.md

@@ -0,0 +1,31 @@
+# Contributing
+
+Pull requests are welcome. Please keep the following in mind:
+
+## What to include
+
+- A short description of what the change does and why.
+- How you tested the change:
+  - **Functionality:** e.g. "signed a 3-page PDF, verified the signature in Acrobat."
+  - **Safety (if applicable):** e.g. "tried uploading a non-PDF file, confirmed it's rejected with a 400."
+- If the change is security-sensitive (auth, file handling, crypto), explain your testing in a bit more detail so reviewers can trust it.
+
+## AI disclosure
+
+If AI was used to help write the code, please note the level of assistance:
+
+- "Authored by AI" - the entire contribution was generated by an AI tool.
+- "Co-authored by AI" - significant portions were AI-generated, but a human reviewed and adjusted them.
+- No disclosure needed for minor AI assistance (e.g. "one or two methods max", autocomplete, boilerplate, refactoring suggestions).
+
+## Code style
+
+This is a tiny project - don't worry about formatting. Just keep it readable and consistent with the surrounding code.
+
+## Commit messages
+
+Describe the changes you made. Following the [conventional commit](https://gist.github.com/qoomon/5dfcdf8eec66a051ecd85625518cfd13) styles is preferred but optional.
+
+## No small readme fixes
+
+Please no cosmetic readme fixes.

README.md

@@ -109,3 +109,7 @@ server {
 3. The script imports each page of the original PDF using FPDI into TCPDF.
 4. TCPDF signs the new PDF with the configured certificate (PEM or PKCS#12).
 5. The signed PDF is downloaded as `signed_<original-name>.pdf`.
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md).