Prepare 0.1.0 for lab release: durable handlers, HTTP Compose, CI, and pulumi-tests.

- Harden DB-backed handlers and seed profiles; align client wire shapes for
  cluster resources, QEMU config, and node SSL fields
- Serve plain HTTP on Compose :8006; keep TLS optional (--profile tls) and
  terminate HTTPS at Kubernetes Ingress
- Add pulumi-tests (full contract surface majors 6–9 + BPG lifecycle) and
  make pulumi-tests
- Ship bilingual docs, CHANGELOG, SECURITY, CONTRIBUTING, and GitHub Actions
  (make ci + Compose/Helm validation)

docs/seed-profiles.md

@@ -1,3 +1,5 @@
+**Language / Язык:** [English](seed-profiles.md) | [Русский](ru/seed-profiles.md)
+
 # Seed profiles
 
 Seeds replace mutable simulation state **atomically** and use deterministic
@@ -13,12 +15,28 @@ make seed PROFILE=small
 |---|---|
 | `minimal` | One node `pve01`, `local` + `local-lvm` storage. Used after Web UI demo unload. |
 | `small` | One node, QEMU `100`/`101`, LXC `200`, storages, completed tasks, full identity set. |
-| `medium` | Three nodes, 50 QEMU, 20 LXC, local + shared storage, development pool, more tasks. |
+| `medium` | Nodes `pve1`/`pve2`/`pve3`, 50 QEMU, 20 LXC, per-node `local-pveN` + storage `shared`, development pool, more tasks. |
 | `large` | Configurable nodes/resources (`SEED_LARGE_NODES`, `SEED_LARGE_RESOURCES`, default 10 000 guests). |
 | `ha-demo` | `medium` plus HA resource wiring for VM 100. |
 | `broken-storage` | `small` with `local-lvm` offline / simulated I/O error. |
 | `demo-cluster` | Large UI-oriented enterprise dataset (many nodes/guests/Ceph/HA/history). Prefer loading via the Web UI demo controls. |
 
+Every profile seeds durable state only — handlers read/write PostgreSQL and do not
+inject catalog/template defaults on GET:
+
+- `clusters.metadata`: firewall (scopes + macros), SDN, notifications (+ matcher
+  catalogs), ACME (accounts/plugins/directories/schema), mappings, replication
+  (+ logs), metrics (servers + export), jobs, HA (`ha` / `ha_groups` / `ha_rules`
+  + status), Ceph (+ pools/cmd_safety), QEMU CPU flags/models, cluster
+  options/config, quorate
+- `nodes.metadata.ops`: network, disks, apt, services, hardware, scan, subscription,
+  dns/time/config/status/ip, certificates, capabilities, hosts, journal/syslog/netstat,
+  report/rrd/rrddata, oci_tags, cluster_status, node Ceph, aplinfo, vzdump defaults
+- guest `resources.state` (via `enrich_guest_state`): agent results/files, rrd/rrddata,
+  migrate_preconditions, LXC interfaces, cloudinit dump
+- storage `storages.config` (via `enrich_storage_state`): rrd/rrddata, file_restore,
+  import_metadata, identity
+
 ## Examples
 
 ```bash
@@ -27,6 +45,9 @@ make seed PROFILE=medium
 make seed PROFILE=ha-demo
 make seed PROFILE=broken-storage
 make seed PROFILE=large
+make seed PROFILE=minimal
+# demo-cluster is large; prefer Web UI demo load for interactive use
+make seed PROFILE=demo-cluster
 ```
 
 ## Demo cluster via UI