Prepare 0.1.0 for lab release: durable handlers, HTTP Compose, CI, and pulumi-tests.

- Harden DB-backed handlers and seed profiles; align client wire shapes for
  cluster resources, QEMU config, and node SSL fields
- Serve plain HTTP on Compose :8006; keep TLS optional (--profile tls) and
  terminate HTTPS at Kubernetes Ingress
- Add pulumi-tests (full contract surface majors 6–9 + BPG lifecycle) and
  make pulumi-tests
- Ship bilingual docs, CHANGELOG, SECURITY, CONTRIBUTING, and GitHub Actions
  (make ci + Compose/Helm validation)

docs/authentication.md

@@ -1,3 +1,5 @@
+**Language / Язык:** [English](authentication.md) | [Русский](ru/authentication.md)
+
 # Authentication
 
 The simulator implements Proxmox-compatible ticket and API-token authentication
@@ -54,8 +56,9 @@ beyond its owner.
 
 ## Seeded development principals
 
-Loaded by every standard seed profile (unless replaced by UI demo unload →
-`minimal`):
+Seeded for **every** profile — including `minimal` and after Web UI demo unload.
+Unload shrinks guests/nodes/storages; lab principals and tokens are still
+inserted by `apply_seed`:
 
 | Principal | Password | Token | Notes |
 |---|---|---|---|