fix: launch must-fix items — security, perf, docs

[patrick-chinchill]

Summary

• Teams JWT bypass: Reject webhooks with 401 when app_id is empty instead of silently skipping JWT verification. Log a warning at init time when app_id is missing.
• Teams SSRF protection: Validate service_url against the Bot Framework allow-list in open_dm and _cache_user_context before using/storing untrusted URLs.
• Teams JWT issuer: Add issuer="https://api.botframework.com" to the pyjwt.decode call.
• Slack client caching: Cache AsyncWebClient instances by token in _get_client() instead of creating a new instance per request.
• README: Add "Why chat-sdk?" value prop and "Compared to Alternatives" table; update version from 0.0.1a1 to 0.0.1a3.
• CONTRIBUTING.md: New file with dev setup, testing, adapter guide, and PR expectations.
• CHANGELOG.md: New file documenting the 0.0.1a3 initial alpha release.

Test plan

• Verify Teams adapter rejects webhooks when TEAMS_APP_ID is unset (returns 401)
• Verify Teams adapter logs warning at init when app_id is empty
• Verify _cache_user_context refuses to cache a non-allowlisted serviceUrl
• Verify open_dm raises ValidationError for non-allowlisted serviceUrl
• Verify JWT decode now requires issuer="https://api.botframework.com"
• Verify Slack _get_client() returns cached client for same token
• Verify README renders correctly and version matches pyproject.toml
• uv run ruff check src/ passes clean

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request updates the project documentation, including the CHANGELOG, README, and a new CONTRIBUTING guide. Functional changes include the introduction of a client cache in the Slack adapter for improved performance and several security enhancements in the Teams adapter, such as stricter app ID enforcement, SSRF protection for service URLs, and refined JWT verification. Review feedback highlights potential memory growth issues in the Slack client cache and the need to offload synchronous JWT key retrieval to a separate thread to prevent blocking the async event loop.

[gemini-code-assist]

The _client_cache dictionary stores AsyncWebClient instances indefinitely. In multi-tenant applications with a large number of workspaces or frequent token rotations, this could lead to significant memory consumption over time. Consider using a cache with an eviction policy (such as an LRU cache) or limiting the maximum number of cached clients to prevent unbounded growth.

[patrick-chinchill]

Addressed in PR #8 (LRU-bounded OrderedDict cache with max=100) and further improved in PR #13 by making client_cache_max configurable via SlackAdapterConfig.

[gemini-code-assist]

The JWT verification process relies on pyjwt's PyJWKClient.get_signing_key_from_jwt, which is a synchronous method that performs network I/O to fetch signing keys. This blocks the event loop, which can impact performance under high concurrency. Since this PR aims to improve performance, consider offloading this blocking call to a thread using asyncio.to_thread (Python 3.9+) or loop.run_in_executor.

[patrick-chinchill]

Fixed in PR #13 -- get_signing_key_from_jwt is now wrapped in asyncio.to_thread() to avoid blocking the event loop during the synchronous JWKS HTTP fetch.