docs: add contributing guidelines and update README for environment variables

- Created a new `CONTRIBUTING.md` file outlining development setup, testing, and commit message conventions.
- Updated `README.md` to clarify environment variable usage, including new variables for HTTP port, CORS origins, and duty display timezone.
- Enhanced documentation for bot commands and API endpoints to improve user understanding and onboarding.
- Added example configurations in `.env.example` for better clarity on optional settings.

CONTRIBUTING.md

@@ -0,0 +1,56 @@
+# Contributing to Duty Teller
+
+## Development setup
+
+1. **Clone the repository**
+   ```bash
+   git clone <repository-url>
+   cd duty-teller
+   ```
+
+2. **Create a virtual environment**
+   ```bash
+   python -m venv venv
+   source venv/bin/activate   # Linux/macOS
+   # or: venv\Scripts\activate  # Windows
+   ```
+
+3. **Install dependencies**
+   ```bash
+   pip install -r requirements.txt
+   pip install -r requirements-dev.txt
+   ```
+
+4. **Configure**
+   ```bash
+   cp .env.example .env
+   ```
+   Set `BOT_TOKEN` and any other variables as needed (see README).
+
+## Running tests and linters
+
+- **Tests** (from repository root; package is `duty_teller`, no `src/`):
+  ```bash
+  pytest
+  ```
+  Use `PYTHONPATH=.` if imports fail.
+
+- **Lint** (ruff):
+  ```bash
+  ruff check duty_teller tests
+  ```
+
+- **Security** (bandit):
+  ```bash
+  bandit -r duty_teller -ll
+  ```
+
+## Commit messages
+
+Use [Conventional Commits](https://www.conventionalcommits.org/), e.g.:
+
+- `feat: add /pin_duty command`
+- `fix: correct timezone in pinned message`
+- `docs: update README env section`
+
+Submit changes via pull requests (Gitea Flow); reviews consider functionality, code quality, and security.