chore: community health files (CoC, SUPPORT, labels, discussions)

[thegdsks]

Summary

Adds the community-health files GitHub auto-detects in the About sidebar plus a label taxonomy and discussion templates. No source or doc rewrites. Complements PRs #69 and #71 without overlap.

What's in

• CODE_OF_CONDUCT.md (Contributor Covenant 2.1). CONTRIBUTING already references a CoC; this points it at the local file.
• SUPPORT.md. The "where do I go for X" routing table. GitHub surfaces it in the About sidebar.
• .github/ISSUE_TEMPLATE/config.yml. Disables blank issues. Surfaces three contact links: private security advisory, Discussions, docs site (theauth.dev).
• .github/DISCUSSION_TEMPLATE/q-and-a.yml and ideas.yml. Structured Q&A and ideas posts so the support channel routes traffic cleanly.
• .github/labels.yml + .github/workflows/labels.yml. Auto-synced label taxonomy: type/, area/ per auth surface, status, priority, semver impact, community. Runs EndBug/label-sync on push to main and via workflow_dispatch.
• .gitignore. Adds *.log, *-CLEANUP-MAP.md, scratch/, tmp/, Thumbs.db so stray artifacts (e.g. MCP server logs) cannot land in commits.

Why

GitHub surfaces CoC, SUPPORT, and issue/discussion templates in the repo About sidebar and issue creation menus. They are the standard signals for a "well-run library" that lift star-conversion and reduce noisy issues. Labels + sync workflow give consistent triage taxonomy without manual upkeep.

Out of scope

• README rewrite (already shipped in docs: pro README + issue/PR templates + CONTRIBUTING #69, docs(readme): better ASCII logo (ANSI Shadow) #72, docs: canonical domain theauth.dev #73)
• Root file consolidation (already shipped in refactor(root): cut root file count for cleaner repo home page #71)
• Moving STABILITY.md / MIGRATION.md to docs/ (already shipped in refactor(root): cut root file count for cleaner repo home page #71)

Test plan

• No em dashes or en dashes
• Existing root markdown unchanged except CONTRIBUTING.md CoC link target
• git diff main..HEAD --stat shows 9 files, 292 insertions, 1 deletion
• CI green
• After merge: labels sync workflow runs and applies taxonomy

[github-actions]

Benchmark regression report

Threshold: 25%

goos: linux
goarch: amd64
pkg: github.com/glincker/theauth-go
cpu: AMD EPYC 9V74 80-Core Processor                
                     │ base-bench.txt │         pr-bench.txt          │
                     │     sec/op     │   sec/op     vs base          │
RateLimitReadHeavy-4      59.46n ± 1%   59.42n ± 8%  ~ (p=0.684 n=10)

                     │ base-bench.txt │          pr-bench.txt          │
                     │      B/op      │    B/op     vs base            │
RateLimitReadHeavy-4       0.000 ± 0%   0.000 ± 0%  ~ (p=1.000 n=10) ¹
¹ all samples are equal

                     │ base-bench.txt │          pr-bench.txt          │
                     │   allocs/op    │ allocs/op   vs base            │
RateLimitReadHeavy-4       0.000 ± 0%   0.000 ± 0%  ~ (p=1.000 n=10) ¹
¹ all samples are equal

pkg: github.com/glincker/theauth-go/crypto
               │ base-bench.txt │            pr-bench.txt            │
               │     sec/op     │   sec/op     vs base               │
Argon2Hash-4        41.63m ± 2%   42.41m ± 2%  +1.87% (p=0.005 n=10)
Argon2Verify-4      41.62m ± 0%   42.27m ± 1%  +1.56% (p=0.000 n=10)
geomean             41.63m        42.34m       +1.71%

               │ base-bench.txt │            pr-bench.txt             │
               │      B/op      │     B/op      vs base               │
Argon2Hash-4       64.01Mi ± 0%   64.01Mi ± 0%       ~ (p=0.684 n=10)
Argon2Verify-4     64.01Mi ± 0%   64.01Mi ± 0%       ~ (p=0.897 n=10)
geomean            64.01Mi        64.01Mi       +0.00%

               │ base-bench.txt │           pr-bench.txt            │
               │   allocs/op    │ allocs/op   vs base               │
Argon2Hash-4         102.0 ± 1%   102.0 ± 1%       ~ (p=0.628 n=10)
Argon2Verify-4       103.0 ± 0%   103.0 ± 0%       ~ (p=1.000 n=10)
geomean              102.5        102.5       +0.00%

pkg: github.com/glincker/theauth-go/internal/bench
                               │ base-bench.txt │            pr-bench.txt            │
                               │     sec/op     │   sec/op     vs base               │
AuditRedactor-4                     1.062µ ± 1%   1.052µ ± 1%  -0.94% (p=0.020 n=10)
OAuthCallback-4                     765.1n ± 0%   769.7n ± 2%  +0.61% (p=0.012 n=10)
OAuthCodeFlow-4                     39.65µ ± 0%   39.81µ ± 1%       ~ (p=0.089 n=10)
OAuthTokenEndpointRefreshHit-4      40.44µ ± 1%   40.81µ ± 1%  +0.90% (p=0.025 n=10)
JWKSEndpoint-4                      4.962µ ± 1%   4.982µ ± 1%       ~ (p=0.616 n=10)
SCIMTokenAuth-4                     12.71µ ± 2%   12.76µ ± 2%       ~ (p=0.128 n=10)
SessionLookup-4                     6.931µ ± 2%   6.853µ ± 1%  -1.13% (p=0.035 n=10)
geomean                             6.641µ        6.647µ       +0.09%

                               │ base-bench.txt │             pr-bench.txt              │
                               │      B/op      │     B/op      vs base                 │
AuditRedactor-4                      672.0 ± 0%     672.0 ± 0%       ~ (p=1.000 n=10) ¹
OAuthCallback-4                    1.344Ki ± 0%   1.344Ki ± 0%       ~ (p=1.000 n=10) ¹
OAuthCodeFlow-4                    15.90Ki ± 0%   15.90Ki ± 0%       ~ (p=0.725 n=10)
OAuthTokenEndpointRefreshHit-4     15.58Ki ± 0%   15.58Ki ± 0%       ~ (p=0.408 n=10)
JWKSEndpoint-4                     2.963Ki ± 0%   2.963Ki ± 0%       ~ (p=1.000 n=10) ¹
SCIMTokenAuth-4                    9.765Ki ± 0%   9.766Ki ± 0%       ~ (p=0.195 n=10)
SessionLookup-4                    8.452Ki ± 0%   8.452Ki ± 0%       ~ (p=1.000 n=10)
geomean                            4.736Ki        4.736Ki       +0.00%
¹ all samples are equal

                               │ base-bench.txt │            pr-bench.txt             │
                               │   allocs/op    │ allocs/op   vs base                 │
AuditRedactor-4                      4.000 ± 0%   4.000 ± 0%       ~ (p=1.000 n=10) ¹
OAuthCallback-4                      5.000 ± 0%   5.000 ± 0%       ~ (p=1.000 n=10) ¹
OAuthCodeFlow-4                      100.0 ± 0%   100.0 ± 0%       ~ (p=1.000 n=10) ¹
OAuthTokenEndpointRefreshHit-4       100.0 ± 0%   100.0 ± 0%       ~ (p=1.000 n=10) ¹
JWKSEndpoint-4                       37.00 ± 0%   37.00 ± 0%       ~ (p=1.000 n=10) ¹
SCIMTokenAuth-4                      56.00 ± 0%   56.00 ± 0%       ~ (p=1.000 n=10) ¹
SessionLookup-4                      42.00 ± 0%   42.00 ± 0%       ~ (p=1.000 n=10) ¹
geomean                              29.04        29.04       +0.00%
¹ all samples are equal

pkg: github.com/glincker/theauth-go/internal/jwt
            │ base-bench.txt │            pr-bench.txt            │
            │     sec/op     │   sec/op     vs base               │
JWTSign-4        25.66µ ± 0%   25.68µ ± 1%       ~ (p=0.271 n=10)
JWTVerify-4      60.20µ ± 1%   60.18µ ± 0%       ~ (p=0.592 n=10)
geomean          39.31µ        39.31µ       +0.02%

            │ base-bench.txt │             pr-bench.txt              │
            │      B/op      │     B/op      vs base                 │
JWTSign-4       2.782Ki ± 0%   2.782Ki ± 0%       ~ (p=1.000 n=10) ¹
JWTVerify-4     3.422Ki ± 0%   3.422Ki ± 0%       ~ (p=1.000 n=10) ¹
geomean         3.086Ki        3.086Ki       +0.00%
¹ all samples are equal

            │ base-bench.txt │            pr-bench.txt             │
            │   allocs/op    │ allocs/op   vs base                 │
JWTSign-4         15.00 ± 0%   15.00 ± 0%       ~ (p=1.000 n=10) ¹
JWTVerify-4       61.00 ± 0%   61.00 ± 0%       ~ (p=1.000 n=10) ¹
geomean           30.25        30.25       +0.00%
¹ all samples are equal

Generated by the bench workflow. A + delta means the PR branch is slower.