Add a stateful Proxmox API console and broad handler coverage beyond the

initial QEMU slice, backed by imported contracts for majors 6–9.
- Implement durable handlers for access/auth, cluster, LXC, storage, HA,
  firewall, Ceph, SDN, ACME, notifications, pools, mapping, and node ops
- Serve an interactive Web UI with catalog browsing, demo seed controls,
  and OpenAPI/help surfaces
- Bundle PVE 6.4-15, 7.4-16, and 8.4.5 contract revisions alongside 9.2.3
- Support in-memory runtime contract Apply (POST /ui/api/contract/apply)
  so /version and /api2 routes follow the selected major until restart
- Expand seed profiles (including demo-cluster), migrations 007–008, TLS
  gateway config, Compose/Makefile tooling, and compatibility evidence
- Tighten .gitignore for macOS, hidden directories (.*/), and local secrets

docs/observability.md

@@ -0,0 +1,41 @@
+# Observability
+
+## Health
+
+| Path | Meaning |
+|---|---|
+| `GET /health/live` | Process liveness |
+| `GET /health/ready` | Database reachable **and** migrations current; HTTP 503 when not |
+
+Example:
+
+```bash
+curl -s http://localhost:8006/health/live
+curl -s http://localhost:8006/health/ready
+```
+
+## Request correlation
+
+Incoming requests accept or generate an ID via `REQUEST_ID_HEADER`
+(default `X-Request-ID`). Structured logs include correlation fields and redact
+known secret patterns.
+
+## Metrics / tracing
+
+There is **no** Prometheus `/metrics` scrape endpoint and **no** bundled
+OpenTelemetry exporter in the current application. Architecture notes that
+mention them describe target design, not shipping telemetry.
+
+Do not confuse Proxmox API paths under `/cluster/metrics` with simulator
+process telemetry — those handlers simulate PVE metrics-server configuration
+state inside PostgreSQL.
+
+## Compatibility evidence
+
+Operational compatibility reports:
+
+- `/admin/compatibility`
+- `/admin/compatibility.md`
+- `/admin/compatibility.html`
+
+Also available through the Web UI compatibility panel.