Public launch phase 2 hardening

[crypticani]

Summary

• Add optional JSON log mirroring to stdout via logging.stdout / TORVIX_LOG_STDOUT, while keeping subsystem log files as the default.
• Return the runtime version from /healthz and centralize the runtime version in internal/version.
• Extend Compose healthchecks with a configurable TORVIX_HEALTH_START_PERIOD defaulting to 120s, and add a dev app healthcheck.
• Add CONTRIBUTING.md and SECURITY.md for public project onboarding and private vulnerability reporting.
• Update examples and deployment docs for stdout logging, healthcheck bootstrap tolerance, and version consistency.

Validation

• env GOCACHE=/tmp/torvix-go-build GOMODCACHE=/tmp/torvix-go-mod go test ./...
• env GOCACHE=/tmp/torvix-go-build GOMODCACHE=/tmp/torvix-go-mod go build ./cmd/... ./internal/...
• make compose-dev-config && make compose-prod-config && jq empty docs/swagger.json && git diff --check
• docker buildx build --check --file Dockerfile .
• env GOCACHE=/tmp/torvix-go-build GOMODCACHE=/tmp/torvix-go-mod go vet ./...
• env GOCACHE=/tmp/torvix-go-build GOMODCACHE=/tmp/torvix-go-mod go run golang.org/x/vuln/cmd/govulncheck@latest ./...
• Post-commit targeted check: env GOCACHE=/tmp/torvix-go-build GOMODCACHE=/tmp/torvix-go-mod go test ./internal/logging ./internal/config ./internal/ports/http ./tests/unit -count=1

Notes

• API auth behavior is unchanged: /healthz and /swagger/* remain public; API, dashboard, reports, waste, metrics, and ingestion endpoints remain bearer-protected when auth is enabled.
• TORVIX_LOG_STDOUT=false keeps current file-only behavior. Set it to true for container log collectors or easier production troubleshooting.