Prepare 0.1.0 for lab release: durable handlers, HTTP Compose, CI, and pulumi-tests.

- Harden DB-backed handlers and seed profiles; align client wire shapes for
  cluster resources, QEMU config, and node SSL fields
- Serve plain HTTP on Compose :8006; keep TLS optional (--profile tls) and
  terminate HTTPS at Kubernetes Ingress
- Add pulumi-tests (full contract surface majors 6–9 + BPG lifecycle) and
  make pulumi-tests
- Ship bilingual docs, CHANGELOG, SECURITY, CONTRIBUTING, and GitHub Actions
  (make ci + Compose/Helm validation)

docker/tls/gateway.conf

@@ -1,5 +1,26 @@
-# Development HTTPS gateway for proxmoxer and other TLS clients.
-# Upstream hostnames are resolved at request time via Docker embedded DNS.
+# Optional / internal TLS terminator.
+#
+# - Host lab default is plain HTTP :8006 on the simulator (no TLS).
+# - Kubernetes HTTPS terminates at Ingress (cert-manager).
+# - This gateway is for HTTPS-only clients (proxmoxer, pulumi-proxmoxve).
+# - Also listen on :80: some bridged providers rewrite https://host:8443 → http://host
+#   on later requests (delete); without :80 those calls fail.
+
+server {
+    listen 80;
+    server_name _;
+    resolver 127.0.0.11 valid=10s ipv6=off;
+    location / {
+        set $upstream simulator:8006;
+        proxy_pass http://$upstream;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Request-ID $request_id;
+    }
+}
 
 server {
     listen 8443 ssl;