docs: add CONTRIBUTING.md, CHANGELOG.md, and JSDoc to entire codebase

Add docs/CONTRIBUTING.md covering the build system, dev workflow, all
npm scripts, how to add new native host message types, code style, and
debugging guidance.

Add CHANGELOG.md at the project root documenting all features and fixes
across the 1.0.0 release.

Add JSDoc (@param, @returns) to all previously undocumented exported
functions across 35 JS files:
- native-host/holesail-manager/ (index, virtual-hosts, service-tunnels,
  servers, port-allocator)
- native-host top-level managers (startup, connect-proxy, https-proxy,
  certificate-authority, ssh-manager, rdp-manager)
- extension/background/ (logs, native-messaging, proxy, message-router)
- extension/dashboard/core/ (utils, navigation, init)
- extension/dashboard/ui/ (modal, toast, state-tag)
- extension/dashboard/pages/ (all 10 page files)
- extension/dashboard/refresh.js, events.js
- extension/dashboard/data/hostname-validator.js
- scripts/ (build-host, run-install)

native-host/holesail-manager/index.js

@@ -14,6 +14,11 @@ const svcModule = require('./service-tunnels.js');
 
 let eventEmit = null;
 
+/**
+ * Register the callback used to push tunnel lifecycle events to the extension.
+ * Must be called before any tunnels are started so events are not lost.
+ * @param {Function} emit - Called as `emit(eventName, payloadObject)`.
+ */
 function setEventEmitter(emit) { eventEmit = emit; }
 function emit(event, payload) { if (eventEmit) eventEmit(event, payload); }
 
@@ -52,12 +57,22 @@ svcModule.init(saveState, emit, settingsModule.getReadyTimeoutMs, settingsModule
 
 // ── Storage path ──────────────────────────────────────────────────────────────
 
+/**
+ * Set the base directory used for state.json persistence.
+ * Must be called before `restorePersistedState`.
+ * @param {string} baseDir - Absolute path to the storage directory.
+ */
 function setStoragePath(baseDir) {
   stateModule.setStoragePath(baseDir);
 }
 
 // ── Restore persisted state ───────────────────────────────────────────────────
 
+/**
+ * Load state.json and apply the persisted settings, connection lists, and ID counters
+ * to all sub-modules. Returns the raw persisted data so the caller can re-start tunnels.
+ * @returns {{settings: object, servers: Array, virtualHosts: Array, serviceTunnels: Array, sshConnections: Array, rdpConnections: Array}}
+ */
 function restorePersistedState() {
   const loaded = stateModule.loadState();
   settingsModule.applyLoaded(loaded.settings);
@@ -76,6 +91,11 @@ function restorePersistedState() {
 
 // ── Cleanup ───────────────────────────────────────────────────────────────────
 
+/**
+ * Close all active tunnels across all sub-modules.
+ * Called during native host shutdown to release resources cleanly.
+ * @returns {Promise<void>}
+ */
 async function cleanup() {
   await serversModule.cleanupServers();
   await vhostsModule.cleanupVirtualHosts();
@@ -126,6 +146,13 @@ module.exports = {
 let Holesail = null;
 try { Holesail = require('holesail'); } catch (_) {}
 
+/**
+ * Resolve an hs:// key via the DHT and return connection metadata without
+ * establishing a full tunnel.
+ * @param {object} payload
+ * @param {string} payload.hsUrl - The hs:// key to look up.
+ * @returns {Promise<{ok: boolean, host?: string, port?: number, protocol?: string, secure?: boolean, error?: string}>}
+ */
 async function lookup(payload) {
   if (!Holesail) return { ok: false, error: 'Holesail module not installed' };
   const url = payload.url || payload.hsUrl;