docs: add CONTRIBUTING.md and document updater EXE usage

CONTRIBUTING.md

@@ -0,0 +1,58 @@
+# Contributing to KeePass Auto Reload
+
+Thank you for your interest in improving KeePass Auto Reload!
+
+## How to Report Bugs
+
+1. Check the [existing issues](https://github.com/hieuck/KeePassAutoReload/issues) to avoid duplicates.
+2. Open a new issue using the **Bug report** template.
+3. Include KeePass version, Windows version, plugin version, and clear reproduction steps.
+4. Attach logs or screenshots if they help explain the problem.
+
+## How to Propose Features
+
+1. Open a new issue using the **Feature request** template.
+2. Describe the use case and the behavior you expect.
+3. Wait for maintainer feedback before investing significant implementation time.
+
+## Development Workflow
+
+This repository uses isolated git worktrees. Feature and fix branches live under `.worktrees/<branch-name>` and are merged through pull requests.
+
+1. Create a new worktree from `main`:
+   ```powershell
+   git worktree add .worktrees/feature-<name> -b feature/<name>
+   cd .worktrees/feature-<name>
+   ```
+2. Make focused, minimal changes.
+3. Ensure `dotnet test tests/KeePassAutoReload.Tests.csproj` passes locally.
+4. Commit using [Conventional Commits](https://www.conventionalcommits.org/):
+   - `feat:` for new features
+   - `fix:` for bug fixes
+   - `refactor:` for code restructuring
+   - `test:` for test-only changes
+   - `docs:` for documentation changes
+   - `ci:` for CI changes
+5. Push the branch and open a pull request.
+6. Wait for CI to pass before merging.
+
+## Code Conventions
+
+- Target .NET Framework 4.8 for the plugin and updater projects.
+- Keep the unit test project (`tests/KeePassAutoReload.Tests.csproj`) passing on .NET 8.
+- Avoid adding new external dependencies unless absolutely necessary.
+- Prefer small, focused changes over large refactoring PRs.
+
+## Testing
+
+Run the test suite with:
+
+```powershell
+dotnet test tests/KeePassAutoReload.Tests.csproj
+```
+
+All changes should include tests when possible. The local plugin build (`msbuild src/KeePassAutoReload.csproj`) requires the .NET Framework 4.8 targeting pack; CI is the authoritative build environment if the targeting pack is not installed locally.
+
+## Code of Conduct
+
+Be respectful and constructive. Harassment or abusive behavior will not be tolerated.

README.md

@@ -18,9 +18,30 @@ By default, automatic sync is skipped when the active KeePass database has unsav
 
 The plugin automatically checks GitHub releases shortly after KeePass starts. Use **Tools -> KeePass Auto Reload -> Check for Updates** to check manually. If a newer version tag is available, the plugin downloads and installs the release asset, then asks you to restart KeePass.
 
+## Auto-Update Behavior
+
+The plugin can check GitHub releases and install updates automatically.
+
+- Update checks and downloads time out after 30 seconds to avoid blocking KeePass.
+- Release assets are verified against `SHA256SUMS.txt` before installation.
+- When an update is installed, the plugin tries to replace its own DLL file. Because Windows locks a loaded DLL, the replacement often cannot happen while KeePass is running.
+- If the DLL is locked, the plugin saves the new file next to the current one with a `.new` extension and launches `KeePassAutoReload.Updater.exe` to perform the replacement after KeePass exits.
+
+### Updater EXE
+
+If you want in-place updates to complete without manual intervention, place `KeePassAutoReload.Updater.exe` in the same folder as `KeePassAutoReload.dll` (the KeePass `Plugins` folder). When an update is downloaded:
+
+1. The plugin writes the new DLL as `KeePassAutoReload.dll.new`.
+2. The updater is started with the KeePass process ID, the `.new` path, the current DLL path, and the KeePass executable path.
+3. The updater waits for KeePass to exit.
+4. The updater copies `KeePassAutoReload.dll.new` over `KeePassAutoReload.dll`.
+5. The updater deletes the `.new` file.
+6. The updater restarts KeePass.
+
+You do not need the updater EXE for the plugin to function; it is only required for fully automatic in-place updates.
+
 ## Requirements & Behavior
 
 - KeePass 2.x on Windows.
 - Outgoing HTTPS connections to GitHub use TLS 1.2 or newer.
-- Update checks and downloads time out after 30 seconds to avoid blocking KeePass.
 - When an update is installed, the plugin replaces its own DLL file wherever KeePass loaded it from. If the plugin file cannot be replaced while KeePass is running, the downloaded file is saved next to it with a `.new` extension.