Prepare 0.1.0 for lab release: durable handlers, HTTP Compose, CI, and pulumi-tests.

- Harden DB-backed handlers and seed profiles; align client wire shapes for
  cluster resources, QEMU config, and node SSL fields
- Serve plain HTTP on Compose :8006; keep TLS optional (--profile tls) and
  terminate HTTPS at Kubernetes Ingress
- Add pulumi-tests (full contract surface majors 6–9 + BPG lifecycle) and
  make pulumi-tests
- Ship bilingual docs, CHANGELOG, SECURITY, CONTRIBUTING, and GitHub Actions
  (make ci + Compose/Helm validation)

docker-compose.release.yml

@@ -1,12 +1,28 @@
 # Quick start with the published Docker Hub runtime image.
 #
+#   WARNING: Laboratory / CI only.
+#   Default TICKET_SIGNING_KEY and PostgreSQL password are intentional lab
+#   defaults. Do NOT expose host :8006 to untrusted networks without replacing
+#   secrets and adding your own controls. See SECURITY.md and docs/security.md.
+#
+#   Requires this repository checkout (compose file).
+#
 #   docker compose -f docker-compose.release.yml up -d
-#   docker compose -f docker-compose.release.yml run --rm --entrypoint python simulator -m app.simulation.seed_cli
+#   docker compose -f docker-compose.release.yml run --rm --entrypoint python \
+#     simulator -m app.simulation.seed_cli
+#   curl -sS http://localhost:8006/health/ready
 #
 # Override the image tag:
 #   IMAGE_TAG=0.1.0 docker compose -f docker-compose.release.yml up -d
 #
-# Change TICKET_SIGNING_KEY before exposing the stack beyond a local lab.
+# Rotate lab secrets before any shared or networked demo:
+#   TICKET_SIGNING_KEY=$(openssl rand -hex 32) \
+#   POSTGRES_PASSWORD=$(openssl rand -hex 16) \
+#   docker compose -f docker-compose.release.yml up -d
+#
+# Optional HTTPS for proxmoxer-style clients (separate port):
+#   docker compose -f docker-compose.release.yml --profile tls up -d
+#   curl -sk https://localhost:8443/health/ready
 
 name: proxmox-api-simulator-release
 
@@ -18,6 +34,7 @@ x-app-env: &app-env
   CONTRACT_SNAPSHOT: /app/contracts/pve-9.2.3.json
   COMPATIBILITY_EVIDENCE: /app/evidence/pve-9.2.3.json
   LOG_LEVEL: ${LOG_LEVEL:-INFO}
+  # Lab default — replace for any shared or networked use.
   TICKET_SIGNING_KEY: ${TICKET_SIGNING_KEY:-development-only-signing-key-change-me}
   TASK_WORKER_CONCURRENCY: ${TASK_WORKER_CONCURRENCY:-2}
   SIMULATION_TIME_SCALE: ${SIMULATION_TIME_SCALE:-10}
@@ -86,3 +103,35 @@ services:
       start_period: 20s
     ports:
       - "${SIMULATOR_PORT:-8006}:8006"
+
+  tls-gateway:
+    profiles: [tls]
+    image: nginx:1.28.0-alpine
+    restart: unless-stopped
+    networks: [simulator]
+    depends_on:
+      simulator:
+        condition: service_healthy
+    ports:
+      - "${TLS_GATEWAY_PORT:-8443}:8443"
+    volumes:
+      - ./docker/tls/gateway.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./docker/tls/server.crt:/etc/nginx/tls/server.crt:ro
+      - ./docker/tls/server.key:/etc/nginx/tls/server.key:ro
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "wget -qO- --no-check-certificate https://127.0.0.1:8443/health/live || exit 1",
+        ]
+      interval: 10s
+      timeout: 3s
+      retries: 5
+      start_period: 5s
+    read_only: true
+    tmpfs:
+      - /var/cache/nginx
+      - /tmp
+      - /var/run
+    security_opt:
+      - no-new-privileges:true