Add a stateful Proxmox API console and broad handler coverage beyond the

initial QEMU slice, backed by imported contracts for majors 6–9.
- Implement durable handlers for access/auth, cluster, LXC, storage, HA,
  firewall, Ceph, SDN, ACME, notifications, pools, mapping, and node ops
- Serve an interactive Web UI with catalog browsing, demo seed controls,
  and OpenAPI/help surfaces
- Bundle PVE 6.4-15, 7.4-16, and 8.4.5 contract revisions alongside 9.2.3
- Support in-memory runtime contract Apply (POST /ui/api/contract/apply)
  so /version and /api2 routes follow the selected major until restart
- Expand seed profiles (including demo-cluster), migrations 007–008, TLS
  gateway config, Compose/Makefile tooling, and compatibility evidence
- Tighten .gitignore for macOS, hidden directories (.*/), and local secrets

docs/domains/tasks.md

@@ -0,0 +1,23 @@
+# Tasks
+
+Long-running operations return a Proxmox-style **UPID**. Task rows, events,
+optional resource locks, and idempotency metadata commit together.
+
+## Client pattern
+
+1. `POST`/`DELETE` mutation → read UPID from `data`
+2. Poll `GET /nodes/{node}/tasks/{upid}/status` until finished
+3. Optionally fetch `.../log`
+
+## Workers
+
+- Claim with `FOR UPDATE SKIP LOCKED`
+- Renewable leases (`TASK_LEASE_SECONDS`)
+- Progress + append-only logs
+- Recovery after process failure
+
+Simulation durations honour `SIMULATION_TIME_SCALE`. Worker lease safety uses
+wall-clock time so an accelerated scenario cannot invalidate distributed claim
+semantics.
+
+See [API surface](../api-surface.md) and [Operations](../operations.md).