docs: community standards, privacy notice and release-body automation

Closes the remaining gaps in GitHub's community-standards check, adds
explicit privacy and dependency documentation matching the plugin's
"DSGVO-by-design" claim, and removes the stale upstream Crowdin
artefact so the repo no longer suggests it ships its own translation
pipeline.

New community-health files:

- CODE_OF_CONDUCT.md: project-specific, short and direct, single
  reporting path to kontakt@hellion-media.de
- CONTRIBUTING.md: scope, accepted vs declined contributions, build
  and test instructions, EUPL-1.2 contribution terms, translation
  policy split between Hellion-specific (here) and upstream strings
  (Chat 2 repo)
- SUPPORT.md: routing for bugs, security, privacy and casual feedback
- .github/PULL_REQUEST_TEMPLATE.md: summary, change-type checklist,
  testing notes, compatibility notes for migrations and manifest
  fields, contribution checklist
- .github/FUNDING.yml: comments-only file, no platforms enabled,
  points donors at the upstream Chat 2 maintainers' Ko-fi pages

New privacy and compliance documentation:

- PRIVACY.md: what the plugin stores locally (config, SQLite,
  EmoteCacheV1), retention defaults, the two outbound network calls
  (BetterTTV API+CDN with ShowEmotes opt-out, Square Enix Lodestone
  font once-off), explicit no-telemetry statement, GDPR
  Art. 15/17/18/20/21 rights mapped to plugin features, third-party
  privacy-policy links
- THIRD_PARTY_NOTICES.md: direct NuGet dependencies with versions
  pinned to v0.5.4 (MessagePack, Microsoft.Data.Sqlite, morelinq,
  Pidgin, SixLabors.ImageSharp under Six Labors Split License 1.0),
  Dalamud SDK and .NET tooling, bundled Exo 2 font (OFL-1.1) and
  plugin icon, network-touch status per component, re-audit commands

Crowdin cleanup:

- crowdin.yml deleted (was upstream Chat 2's project_id 663694,
  pointed at /ChatTwo/Resources/Language.resx, never wired to
  HellionChat strings)
- README, CONTRIBUTING and CODE_OF_CONDUCT no longer suggest
  HellionChat operates a Crowdin project; remaining mentions are
  explicitly framed as upstream Chat 2's workflow

Contact and version consistency:

- Maintainer email switched from maintainer@hellion-media.de to
  kontakt@hellion-media.de in SECURITY.md and NOTICE.md
- README version references updated to 0.5.4 (header, project status
  block) and the update-tag pattern generalised from v0.1.x to v0.X.Y
- bug_report.yml version placeholder bumped to 0.5.4
- Project-documents table added to README footer linking all health
  and reference files in one place

Release-body automation:

- .github/workflows/release.yml now extracts the matching version
  block from ChatTwo/HellionChat.yaml's changelog and combines it
  with a static install / docs footer (custom-repo URL, project
  document links, licence) before passing the result to
  softprops/action-gh-release@v3 via body_path
- Workflow fails fast if no changelog block exists for the tagged
  version, automating the existing "yaml + repo.json + release body
  kept in sync" rule
- Tag value passed via env: TAG_NAME with strict ^v\d+\.\d+\.\d+$
  validation before any string concatenation, so the tag input cannot
  break out into shell evaluation

CODE_OF_CONDUCT.md

@@ -0,0 +1,71 @@
+# Code of conduct
+
+HellionChat is a small hobby project. The contributor base is tiny and
+the moderation overhead I can afford is equally small, so this document
+is short and direct.
+
+## What I expect from contributors
+
+- Be respectful in issues, pull requests, discussions and any other
+  project space (Discord, email).
+- Keep feedback focused on the code, the design or the documentation.
+  Critique the work, not the person.
+- Assume good intent. People come from different backgrounds, time
+  zones and skill levels. A clarifying question is almost always a
+  better first move than an accusation.
+- Stay on topic. This project is about a Dalamud chat plugin. Off-topic
+  arguments belong elsewhere.
+- Respect that I maintain this in my spare time. Replies can take a
+  few days. Please do not escalate just because a thread is quiet.
+
+## What is not welcome
+
+- Personal attacks, slurs, doxxing, sustained disruption of threads.
+- Unsolicited private contact after I have asked someone to stop.
+- Sharing of private conversations without consent.
+- Any content that would put other contributors or end users at risk.
+
+## Scope
+
+This applies to every space the project owns or that I run on its
+behalf: the GitHub repository, GitHub Discussions, project-related
+Discord conversations and the maintainer email address listed in
+`SECURITY.md`.
+
+It also applies when someone is identifiably representing the project
+in another space, for example posting as a HellionChat maintainer in
+the Dalamud Discord.
+
+## Reporting
+
+If something here is being broken, contact me directly. Do not open a
+public issue.
+
+- Email: `kontakt@hellion-media.de`
+- Discord DM: `@j.j_kazama`
+
+Reports stay private. I will acknowledge within a few weekdays
+(European business hours) and tell you what I plan to do.
+
+## Enforcement
+
+I am the sole maintainer, so enforcement is a single-person process.
+Depending on what happened and how the person responds, I will pick
+the lightest measure that resolves the issue:
+
+1. Private note asking the behaviour to stop.
+2. Public correction in the affected thread.
+3. Edit or removal of the offending content.
+4. Temporary block from the repository or related spaces.
+5. Permanent block.
+
+Severe cases skip the lower steps. I will not negotiate over
+harassment or threats.
+
+## Acknowledgement
+
+This document is intentionally short and project-specific rather than
+a copy of a longer template. If you need a more formal reference, the
+[Contributor Covenant](https://www.contributor-covenant.org/) is a
+widely adopted starting point and the spirit of this document is
+compatible with it.