Prepare 0.1.0 for lab release: durable handlers, HTTP Compose, CI, and pulumi-tests.

- Harden DB-backed handlers and seed profiles; align client wire shapes for
  cluster resources, QEMU config, and node SSL fields
- Serve plain HTTP on Compose :8006; keep TLS optional (--profile tls) and
  terminate HTTPS at Kubernetes Ingress
- Add pulumi-tests (full contract surface majors 6–9 + BPG lifecycle) and
  make pulumi-tests
- Ship bilingual docs, CHANGELOG, SECURITY, CONTRIBUTING, and GitHub Actions
  (make ci + Compose/Helm validation)

tests/unit/test_dynamic_routes.py

@@ -5,11 +5,15 @@ from pathlib import Path
 from typing import Any
 
 import pytest
-from fastapi import Request
+from fastapi import FastAPI, Request
 from httpx import ASGITransport, AsyncClient
 from pydantic import ValidationError
 
-from app.api.registry import HandlerRegistry, RouteCollisionError
+from app.api.registry import (
+    HandlerRegistry,
+    RouteCollisionError,
+    register_unbound_handler_routes,
+)
 from app.config import Settings
 from app.contracts.model import Method, PathContract, Schema, Snapshot
 from app.main import create_app
@@ -97,3 +101,21 @@ def test_duplicate_semantic_handlers_are_rejected() -> None:
     handlers.register("/version", "GET", handler)
     with pytest.raises(RouteCollisionError, match="duplicate"):
         handlers.register("/version", "GET", handler)
+
+
+def test_unbound_handler_routes_are_mounted() -> None:
+    app = FastAPI()
+    handlers = HandlerRegistry()
+
+    async def firewall_log(_request: Request, _inputs: dict[str, Any]) -> list[dict[str, Any]]:
+        return [{"n": 0, "msg": "from-db"}]
+
+    handlers.register("/cluster/firewall/log", "GET", firewall_log)
+    register_unbound_handler_routes(app, handlers, "error")
+
+    routes = {
+        (getattr(route, "path", None), tuple(sorted(getattr(route, "methods", set()) or set())))
+        for route in app.routes
+    }
+    assert ("/api2/json/cluster/firewall/log", ("GET",)) in routes
+    assert ("/api2/extjs/cluster/firewall/log", ("GET",)) in routes