docs: add CONTRIBUTING.md, CHANGELOG.md, and JSDoc to entire codebase

Add docs/CONTRIBUTING.md covering the build system, dev workflow, all
npm scripts, how to add new native host message types, code style, and
debugging guidance.

Add CHANGELOG.md at the project root documenting all features and fixes
across the 1.0.0 release.

Add JSDoc (@param, @returns) to all previously undocumented exported
functions across 35 JS files:
- native-host/holesail-manager/ (index, virtual-hosts, service-tunnels,
  servers, port-allocator)
- native-host top-level managers (startup, connect-proxy, https-proxy,
  certificate-authority, ssh-manager, rdp-manager)
- extension/background/ (logs, native-messaging, proxy, message-router)
- extension/dashboard/core/ (utils, navigation, init)
- extension/dashboard/ui/ (modal, toast, state-tag)
- extension/dashboard/pages/ (all 10 page files)
- extension/dashboard/refresh.js, events.js
- extension/dashboard/data/hostname-validator.js
- scripts/ (build-host, run-install)

native-host/https-proxy.js

@@ -42,12 +42,24 @@ let proxyCertsDirOrCA = null;
 
 const trafficStats = { bytesIn: 0, bytesOut: 0, requests: 0 };
 
+/**
+ * Return a snapshot of cumulative traffic counters since the last reset.
+ * @returns {{bytesIn: number, bytesOut: number, requests: number}}
+ */
 function getTrafficStats() { return { ...trafficStats }; }
+/**
+ * Reset all traffic counters to zero.
+ */
 function resetTrafficStats() { trafficStats.bytesIn = 0; trafficStats.bytesOut = 0; trafficStats.requests = 0; }
 
 /** Resolver: hostname -> { host, port } | port | null */
 let getBackendForHostname = null;
 
+/**
+ * Register the function used to resolve a virtual hostname to its local backend.
+ * Must be called before `start`. Called by message-router with `holesailManager.getLocalBackend`.
+ * @param {Function} fn - Called as `fn(hostname)` and should return `{host, port}` or null.
+ */
 function setHostnameResolver (fn) {
   getBackendForHostname = fn;
 }
@@ -513,6 +525,15 @@ class FakeHttpServer extends EventEmitter {
 // Public API
 // ---------------------------------------------------------------------------
 
+/**
+ * Start the SNI-aware HTTPS reverse proxy.
+ * Exits the process if the port is already in use (another instance running).
+ * @param {number} [port=8443] - Port to listen on.
+ * @param {object} certsDirOrCA - The certificate-authority module (provides `getOrCreateWildcardCert`).
+ * @param {Function} [callback] - Called as `callback(err)` once listening.
+ * @param {string[]} [_baseDomains] - Reserved; unused in current implementation.
+ * @returns {object} The fake HTTP server EventEmitter.
+ */
 function start (port, certsDirOrCA, callback, _baseDomains) {
   if (proxyServer) {
     if (callback) callback(null);
@@ -562,6 +583,10 @@ function start (port, certsDirOrCA, callback, _baseDomains) {
   return fakeServer;
 }
 
+/**
+ * Destroy all active connections and close the TCP server.
+ * @param {Function} [callback] - Called once the server is fully closed.
+ */
 function stop (callback) {
   if (!proxyServer) {
     if (callback) callback();
@@ -590,6 +615,12 @@ function stop (callback) {
   });
 }
 
+/**
+ * Stop and restart the proxy on the same port, re-using the existing CA.
+ * Used when the proxy port setting changes.
+ * @param {string[]} baseDomains - Unused; reserved for future pre-generation of certs.
+ * @param {Function} [callback] - Called as `callback(err)` once the new server is listening.
+ */
 function restart (baseDomains, callback) {
   const savedPort = proxyPort || DEFAULT_PORT;
   const ca = proxyCertsDirOrCA;
@@ -602,6 +633,10 @@ function restart (baseDomains, callback) {
   });
 }
 
+/**
+ * Return the port the proxy is currently listening on, or null if not started.
+ * @returns {number|null}
+ */
 function getPort () {
   return proxyPort;
 }