Add a stateful Proxmox API console and broad handler coverage beyond the

initial QEMU slice, backed by imported contracts for majors 6–9.
- Implement durable handlers for access/auth, cluster, LXC, storage, HA,
  firewall, Ceph, SDN, ACME, notifications, pools, mapping, and node ops
- Serve an interactive Web UI with catalog browsing, demo seed controls,
  and OpenAPI/help surfaces
- Bundle PVE 6.4-15, 7.4-16, and 8.4.5 contract revisions alongside 9.2.3
- Support in-memory runtime contract Apply (POST /ui/api/contract/apply)
  so /version and /api2 routes follow the selected major until restart
- Expand seed profiles (including demo-cluster), migrations 007–008, TLS
  gateway config, Compose/Makefile tooling, and compatibility evidence
- Tighten .gitignore for macOS, hidden directories (.*/), and local secrets

docs/security.md

@@ -0,0 +1,42 @@
+# Security
+
+## Lab threat model
+
+This project is a **local / CI laboratory simulator**. It is not hardened as a
+multi-tenant public Proxmox service. Default credentials, UI demo controls, and
+compatibility endpoints are convenient for development and intentionally open
+in the default Compose stack.
+
+Do not expose ports `8006` / `8007` to untrusted networks without additional
+controls you supply yourself.
+
+## Credentials and secrets
+
+- Passwords and API-token secrets are stored as scrypt hashes.
+- Ticket values are HMAC-signed and short-lived.
+- CSRF binds mutations to ticket sessions.
+- Logs redact recognized ticket, password, and token representations.
+- Create/regenerate token responses show the secret once; GET never echoes it.
+
+Change `TICKET_SIGNING_KEY` for any shared lab. Replace seeded passwords and
+tokens before demoing to others.
+
+## TLS materials
+
+`docker/tls/` contains a checked-in self-signed certificate for the local
+gateway. It exists so unmodified TLS clients (e.g. proxmoxer) can connect.
+**Never** reuse these files in production.
+
+## Simulator administration
+
+There is currently **no** separately authenticated `/_simulator` control plane.
+Web UI helper routes under `/ui/api/*` and `/admin/compatibility*` are available
+whenever the process is reachable. Treat network exposure as the trust
+boundary.
+
+## Simulated remotes
+
+LDAP sync stamps, OpenID pending state, ACME, and Ceph endpoints persist local
+simulator state only. They do not open real connections to external IdPs or
+clusters. Do not rely on the simulator for testing live credential exfiltration
+defenses against real providers.