Prepare 0.1.0 for lab release: durable handlers, HTTP Compose, CI, and pulumi-tests.

- Harden DB-backed handlers and seed profiles; align client wire shapes for
  cluster resources, QEMU config, and node SSL fields
- Serve plain HTTP on Compose :8006; keep TLS optional (--profile tls) and
  terminate HTTPS at Kubernetes Ingress
- Add pulumi-tests (full contract surface majors 6–9 + BPG lifecycle) and
  make pulumi-tests
- Ship bilingual docs, CHANGELOG, SECURITY, CONTRIBUTING, and GitHub Actions
  (make ci + Compose/Helm validation)

docs/architecture.md

@@ -1,3 +1,5 @@
+**Language / Язык:** [English](architecture.md) | [Русский](ru/architecture.md)
+
 # Architecture
 
 ## Goals
@@ -30,7 +32,7 @@ flowchart LR
     Obs["Logs / Prometheus / OpenTelemetry"]
 
     Client -->|"/api2/json"| API
-    Admin -->|"CLI and /_simulator"| API
+    Admin -->|"CLI, Make/Helm, Web UI /ui/api"| API
     Docs -->|"explicit import only"| Importer
     Importer --> Contract
     Contract --> DB