docs: add CONTRIBUTING.md, CHANGELOG.md, and JSDoc to entire codebase

Add docs/CONTRIBUTING.md covering the build system, dev workflow, all
npm scripts, how to add new native host message types, code style, and
debugging guidance.

Add CHANGELOG.md at the project root documenting all features and fixes
across the 1.0.0 release.

Add JSDoc (@param, @returns) to all previously undocumented exported
functions across 35 JS files:
- native-host/holesail-manager/ (index, virtual-hosts, service-tunnels,
  servers, port-allocator)
- native-host top-level managers (startup, connect-proxy, https-proxy,
  certificate-authority, ssh-manager, rdp-manager)
- extension/background/ (logs, native-messaging, proxy, message-router)
- extension/dashboard/core/ (utils, navigation, init)
- extension/dashboard/ui/ (modal, toast, state-tag)
- extension/dashboard/pages/ (all 10 page files)
- extension/dashboard/refresh.js, events.js
- extension/dashboard/data/hostname-validator.js
- scripts/ (build-host, run-install)

native-host/certificate-authority.js

@@ -169,6 +169,12 @@ if (_needsGeneration) {
   }
 }
 
+/**
+ * Install the root CA certificate into the OS trust store.
+ * Uses `security add-trusted-cert` on macOS (with GUI sudo prompt),
+ * `update-ca-certificates` on Linux, and `certutil` on Windows.
+ * @param {Function} callback - Called as `callback(err)` on completion.
+ */
 function installRootCA(callback) {
   if (typeof callback !== 'function') callback = () => {};
   if (!spawn) {
@@ -307,6 +313,15 @@ function installRootCA(callback) {
   callback(null);
 }
 
+/**
+ * Get or create a TLS certificate for the given domain, signed by the root CA.
+ * Certificates are cached on disk in `<certsDir>/<domain>/`. Returns `{ cert, key }`
+ * buffers, or null if the CA is not yet ready.
+ * @param {string} domain - Certificate common name / directory key.
+ * @param {Array<{type: number, value: string}>} altNames - Subject Alternative Names.
+ * @param {boolean} [forceRegenerate=false] - If true, regenerate even if a cached cert exists.
+ * @returns {{cert: Buffer, key: Buffer}|null}
+ */
 function getOrCreateDomainCert(domain, altNames, forceRegenerate) {
   if (!domain) return null;
   const domainDir = path.join(certsDir, domain.replace(/\*/g, 'wildcard'));
@@ -376,14 +391,27 @@ function getOrCreateDomainCert(domain, altNames, forceRegenerate) {
   }
 }
 
+/**
+ * Return the absolute path to the root CA certificate PEM file.
+ * @returns {string}
+ */
 function getCaCertPath() {
   return caCertPath;
 }
 
+/**
+ * Return the absolute path to the directory where all certificates are stored.
+ * @returns {string}
+ */
 function getCertsDir() {
   return certsDir;
 }
 
+/**
+ * Check whether the root CA is currently trusted by the OS.
+ * The check is platform-specific and compares SHA-256 fingerprints.
+ * @param {Function} callback - Called as `callback(isInstalled: boolean)`.
+ */
 function isRootCAInstalled(callback) {
   if (platform === 'darwin') {
     // Check SSL trust policy AND that the fingerprint matches the current CA on disk.