Prepare 0.1.0 for lab release: durable handlers, HTTP Compose, CI, and pulumi-tests.

- Harden DB-backed handlers and seed profiles; align client wire shapes for
  cluster resources, QEMU config, and node SSL fields
- Serve plain HTTP on Compose :8006; keep TLS optional (--profile tls) and
  terminate HTTPS at Kubernetes Ingress
- Add pulumi-tests (full contract surface majors 6–9 + BPG lifecycle) and
  make pulumi-tests
- Ship bilingual docs, CHANGELOG, SECURITY, CONTRIBUTING, and GitHub Actions
  (make ci + Compose/Helm validation)

docker-compose.yml

@@ -12,8 +12,9 @@ x-dev-env: &dev-env
   TEST_DATABASE_URL: postgresql://proxmox:proxmox@postgres:5432/proxmox_simulator
   CONTRACT_SNAPSHOT: /workspace/contracts/e61a893e996d05d376579226e7dfbedbcfce8b71787adacffbc557e6e35901c1/snapshot.json
   COMPATIBILITY_EVIDENCE: /workspace/evidence/pve-9.2.3.json
-  PROXMOXER_HOST: tls-gateway
-  PROXMOXER_PORT: "8443"
+  # proxmoxer is HTTPS-only — set when using --profile tls (see Makefile test-compatibility)
+  PROXMOXER_HOST: ${PROXMOXER_HOST:-}
+  PROXMOXER_PORT: ${PROXMOXER_PORT:-8443}
   LOG_LEVEL: INFO
   TICKET_SIGNING_KEY: development-only-signing-key-change-me
 
@@ -108,9 +109,12 @@ services:
       retries: 8
       start_period: 20s
     ports:
-      - "8006:8006"
+      - "${SIMULATOR_PORT:-8006}:8006"
 
+  # Optional HTTPS front for clients that cannot speak plain HTTP (proxmoxer).
+  # Default lab URL is http://localhost:8006/ — K8s TLS is Ingress-only.
   tls-gateway:
+    profiles: [tls]
     image: nginx:1.28.0-alpine
     restart: unless-stopped
     networks: [simulator]
@@ -118,7 +122,7 @@ services:
       simulator:
         condition: service_healthy
     ports:
-      - "8007:8443"
+      - "${TLS_GATEWAY_PORT:-8443}:8443"
     volumes:
       - ./docker/tls/gateway.conf:/etc/nginx/conf.d/default.conf:ro
       - ./docker/tls/server.crt:/etc/nginx/tls/server.crt:ro