docs: add support policy

.github/ISSUE_TEMPLATE/config.yml

@@ -6,3 +6,6 @@ contact_links:
   - name: Release readiness and contribution rules
     url: https://github.com/lanmu1818-ship-it/ai-chatbot/blob/main/CONTRIBUTING.md
     about: Read docs/release-readiness.md and CONTRIBUTING.md before opening broad engineering requests.
+  - name: Support and operations help
+    url: https://github.com/lanmu1818-ship-it/ai-chatbot/blob/main/SUPPORT.md
+    about: Read SUPPORT.md for bug, feature, deployment, operations, and security support boundaries.

README.md

@@ -114,6 +114,7 @@ tests/                       Playwright e2e and route-level tests
 - [安全策略](SECURITY.md)
 - [贡献指南](CONTRIBUTING.md)
 - [行为准则](CODE_OF_CONDUCT.md)
+- [支持说明](SUPPORT.md)
 
 ## 开发边界
 

SUPPORT.md

@@ -0,0 +1,57 @@
+# Support
+
+This document explains where to ask for help and what information to include.
+
+## Before Asking
+
+Please check:
+
+- `README.md` for setup and project boundaries.
+- `docs/deployment.md` for production deployment.
+- `docs/operations.md` for quality gates, logging, and smoke tests.
+- `docs/release-readiness.md` for release verification.
+- Existing GitHub issues.
+
+## Bugs
+
+Use the Bug report issue template when you can provide reproduction steps.
+
+Include:
+
+- What happened and what you expected.
+- Route, workflow, or UI area affected.
+- Browser, OS, Node, pnpm, and deployment context when relevant.
+- Sanitized logs or screenshots.
+
+Do not include secrets, cookies, OAuth codes, Authorization headers, signed URLs, `.env.local` values, private prompts, base64 data, or private user content.
+
+## Feature Requests
+
+Use the Feature request issue template. Keep proposals focused and include:
+
+- The user or operator problem.
+- Proposed behavior or API shape.
+- Acceptance criteria.
+- Relevant alternatives considered.
+
+## Security Issues
+
+Do not open public issues for vulnerabilities, auth bypasses, token leaks, signed URL exposure, private data exposure, or suspicious dependency behavior.
+
+Follow `SECURITY.md` and report privately to the maintainer.
+
+## Deployment and Operations Help
+
+For deployment questions, include sanitized versions of:
+
+- Hosting target.
+- Node and pnpm versions.
+- Database/storage provider type.
+- Relevant command output.
+- Whether `pnpm check:quality` and `pnpm smoke:routes` pass.
+
+Never paste real environment variables. Use placeholder names from `.env.example`.
+
+## Maintainer Expectations
+
+The project is maintained as a production-oriented codebase. Issues and discussions that include unsafe secrets, private user data, or unsanitized provider payloads may be edited or closed to protect users and operators.