chore: stabilize main branch with dev workflow + PR guidelines

- Set dev as default branch, protect main (owner-only merge)
- Add CI trigger for PRs targeting dev
- Add PR template with checklist and branch targeting guide
- Add CONTRIBUTING.md with branch strategy and review criteria
- Update README clone command to use -b main for stable

.github/pull_request_template.md

@@ -0,0 +1,34 @@
+## Summary
+<!-- 1-2 sentences: What does this PR do and why? -->
+
+## Type
+<!-- Check one -->
+- [ ] Feature
+- [ ] Bug fix
+- [ ] Hotfix (targeting `main`)
+- [ ] Refactor
+- [ ] Docs
+- [ ] CI/CD
+
+## Target Branch
+<!--
+  ⚠️  IMPORTANT: Read before submitting!
+
+  - Features/bugfixes → `dev` (default)
+  - Hotfixes only → `main` (cherry-pick back to `dev` after merge)
+  - DO NOT target `main` for regular development
+-->
+
+## Checklist
+- [ ] `go build ./...` passes
+- [ ] `go build -tags sqliteonly ./...` passes (if Go changes)
+- [ ] `go vet ./...` passes
+- [ ] Tests pass: `go test -race ./...`
+- [ ] Web UI builds: `cd ui/web && pnpm build` (if UI changes)
+- [ ] No hardcoded secrets or credentials
+- [ ] SQL queries use parameterized `$1, $2` (no string concat)
+- [ ] New user-facing strings added to all 3 locales (en/vi/zh)
+- [ ] Migration version bumped in `internal/upgrade/version.go` (if new migration)
+
+## Test Plan
+<!-- How was this tested? -->