docs: add CONTRIBUTING.md, CHANGELOG.md, and JSDoc to entire codebase

Add docs/CONTRIBUTING.md covering the build system, dev workflow, all
npm scripts, how to add new native host message types, code style, and
debugging guidance.

Add CHANGELOG.md at the project root documenting all features and fixes
across the 1.0.0 release.

Add JSDoc (@param, @returns) to all previously undocumented exported
functions across 35 JS files:
- native-host/holesail-manager/ (index, virtual-hosts, service-tunnels,
  servers, port-allocator)
- native-host top-level managers (startup, connect-proxy, https-proxy,
  certificate-authority, ssh-manager, rdp-manager)
- extension/background/ (logs, native-messaging, proxy, message-router)
- extension/dashboard/core/ (utils, navigation, init)
- extension/dashboard/ui/ (modal, toast, state-tag)
- extension/dashboard/pages/ (all 10 page files)
- extension/dashboard/refresh.js, events.js
- extension/dashboard/data/hostname-validator.js
- scripts/ (build-host, run-install)

native-host/holesail-manager/port-allocator.js

@@ -9,11 +9,21 @@ const TUNNEL_PORT_BASE = 19000;
 let nextTunnelPortIndex = 0;
 const tunnelPortFreeList = [];
 
+/**
+ * Allocate a unique local port for a virtual host tunnel.
+ * Recycles ports from the free list before incrementing the counter.
+ * @returns {number} An available port number >= TUNNEL_PORT_BASE.
+ */
 function allocateTunnelPort() {
   if (tunnelPortFreeList.length > 0) return tunnelPortFreeList.pop();
   return TUNNEL_PORT_BASE + (nextTunnelPortIndex++);
 }
 
+/**
+ * Return a port to the free list so it can be reused by a future allocation.
+ * Silently ignores invalid ports and duplicate releases.
+ * @param {number} port - The port to release. Must be >= TUNNEL_PORT_BASE.
+ */
 function releaseTunnelPort(port) {
   if (typeof port === 'number' && port >= TUNNEL_PORT_BASE && !tunnelPortFreeList.includes(port)) {
     tunnelPortFreeList.push(port);