Add a stateful Proxmox API console and broad handler coverage beyond the

initial QEMU slice, backed by imported contracts for majors 6–9.
- Implement durable handlers for access/auth, cluster, LXC, storage, HA,
  firewall, Ceph, SDN, ACME, notifications, pools, mapping, and node ops
- Serve an interactive Web UI with catalog browsing, demo seed controls,
  and OpenAPI/help surfaces
- Bundle PVE 6.4-15, 7.4-16, and 8.4.5 contract revisions alongside 9.2.3
- Support in-memory runtime contract Apply (POST /ui/api/contract/apply)
  so /version and /api2 routes follow the selected major until restart
- Expand seed profiles (including demo-cluster), migrations 007–008, TLS
  gateway config, Compose/Makefile tooling, and compatibility evidence
- Tighten .gitignore for macOS, hidden directories (.*/), and local secrets

.gitignore

@@ -1,14 +1,75 @@
+# Hidden directories (.cursor/, .pytest_cache/, .mypy_cache/, .ruff_cache/, …)
+.*/
+# Keep GitHub Actions / repo metadata trackable despite the rule above.
+!.github/
+!.github/**
+
+# macOS
+.DS_Store
+.AppleDouble
+.LSOverride
+._*
+.DocumentRevisions-V100
+.fseventsd
+.Spotlight-V100
+.TemporaryItems
+.Trashes
+.VolumeIcon.icns
+.com.apple.timemachine.donotpresent
+.AppleDB
+.AppleDesktop
+.apdisk
+Network Trash Folder
+Temporary Items
+
+# Environment / secrets (keep .env.example tracked)
 .env
-.venv/
+.env.local
+.env.*.local
+
+# Python
 __pycache__/
 *.py[cod]
-.coverage
-coverage.xml
-htmlcov/
-.mypy_cache/
-.pytest_cache/
-.ruff_cache/
+*$py.class
+*.so
+.Python
+*.egg
+*.egg-info/
+.eggs/
 dist/
 build/
-*.egg-info/
+wheels/
+pip-wheel-metadata/
+share/python-wheels/
+*.manifest
+*.spec
+pip-log.txt
+pip-delete-this-directory.txt
+.venv/
+venv/
+ENV/
+env/
 
+# Test / coverage leftovers (directories also covered by .*/)
+.coverage
+.coverage.*
+coverage.xml
+htmlcov/
+.cache
+nosetests.xml
+pytestdebug.log
+hypothesis/
+
+# Editors / IDE leftovers outside .*
+*.swp
+*.swo
+*~
+*.sublime-project
+*.sublime-workspace
+
+# Docker / local runtime
+*.log
+docker-compose.override.yml
+
+# Lab probe output (regenerated by scripts/probe_api_surface.py)
+evidence/_api_surface_probe.json