Prepare 0.1.0 for lab release: durable handlers, HTTP Compose, CI, and pulumi-tests.

- Harden DB-backed handlers and seed profiles; align client wire shapes for
  cluster resources, QEMU config, and node SSL fields
- Serve plain HTTP on Compose :8006; keep TLS optional (--profile tls) and
  terminate HTTPS at Kubernetes Ingress
- Add pulumi-tests (full contract surface majors 6–9 + BPG lifecycle) and
  make pulumi-tests
- Ship bilingual docs, CHANGELOG, SECURITY, CONTRIBUTING, and GitHub Actions
  (make ci + Compose/Helm validation)

pulumi-tests/docker/Dockerfile.pulumi-runner

@@ -0,0 +1,22 @@
+FROM python:3.13-bookworm
+
+ARG PULUMI_VERSION=3.193.0
+ARG PULUMI_PROXMOXVE_VERSION=8.2.1
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends curl ca-certificates \
+    && curl -fsSL https://get.pulumi.com | sh -s -- --version "${PULUMI_VERSION}" \
+    && ln -s /root/.pulumi/bin/pulumi /usr/local/bin/pulumi \
+    && pip install --no-cache-dir \
+        "httpx==0.28.1" \
+        "pulumi==${PULUMI_VERSION}" \
+        "pulumi-proxmoxve==${PULUMI_PROXMOXVE_VERSION}" \
+    && pulumi plugin install resource proxmoxve "${PULUMI_PROXMOXVE_VERSION}" \
+        --server github://api.github.com/muhlba91/pulumi-proxmoxve \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace/pulumi-tests
+ENV PYTHONPATH=/workspace/pulumi-tests/pulumi:/workspace/pulumi-tests
+ENV PULUMI_CONFIG_PASSPHRASE=hx-test-passphrase
+
+CMD ["python", "pulumi/run_suite.py"]