Add self-contained API simulators lab with Compose and Helm.

Ship Proxmox, oVirt, VMware, and OpenStack behind one Postgres stack,
Makefile helpers (up/clean/helm up|down/push), and a Helm chart with
namespace, Let's Encrypt ingresses, migrate inits, and skip-if-seeded jobs.

docker/ovirt/ovirt-engine.conf

@@ -0,0 +1,49 @@
+# nginx gateway — only two public listeners:
+#   :443  Engine API + SSO (/ovirt-engine/…)
+#   :5000 Web UI console
+# Upstream FastAPI listens on simulator:8080.
+
+upstream ovirt_simulator {
+    server simulator:8080;
+    keepalive 32;
+}
+
+# --- Engine HTTPS (API + SSO) ---
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name _;
+
+    ssl_certificate     /etc/nginx/tls/server.crt;
+    ssl_certificate_key /etc/nginx/tls/server.key;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+
+    client_max_body_size 64m;
+
+    location / {
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-Port 443;
+        proxy_pass http://ovirt_simulator;
+    }
+}
+
+# --- Simulator Web UI console ---
+server {
+    listen 5000;
+    listen [::]:5000;
+    server_name _;
+
+    location / {
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Port 5000;
+        proxy_pass http://ovirt_simulator;
+    }
+}