Add a stateful Proxmox API console and broad handler coverage beyond the

initial QEMU slice, backed by imported contracts for majors 6–9.
- Implement durable handlers for access/auth, cluster, LXC, storage, HA,
  firewall, Ceph, SDN, ACME, notifications, pools, mapping, and node ops
- Serve an interactive Web UI with catalog browsing, demo seed controls,
  and OpenAPI/help surfaces
- Bundle PVE 6.4-15, 7.4-16, and 8.4.5 contract revisions alongside 9.2.3
- Support in-memory runtime contract Apply (POST /ui/api/contract/apply)
  so /version and /api2 routes follow the selected major until restart
- Expand seed profiles (including demo-cluster), migrations 007–008, TLS
  gateway config, Compose/Makefile tooling, and compatibility evidence
- Tighten .gitignore for macOS, hidden directories (.*/), and local secrets

docs/seed-profiles.md

@@ -0,0 +1,47 @@
+# Seed profiles
+
+Seeds replace mutable simulation state **atomically** and use deterministic
+UUIDv5 identifiers so labs are reproducible.
+
+```bash
+make seed PROFILE=small
+```
+
+## Profiles
+
+| Profile | Contents (summary) |
+|---|---|
+| `minimal` | One node `pve01`, `local` + `local-lvm` storage. Used after Web UI demo unload. |
+| `small` | One node, QEMU `100`/`101`, LXC `200`, storages, completed tasks, full identity set. |
+| `medium` | Three nodes, 50 QEMU, 20 LXC, local + shared storage, development pool, more tasks. |
+| `large` | Configurable nodes/resources (`SEED_LARGE_NODES`, `SEED_LARGE_RESOURCES`, default 10 000 guests). |
+| `ha-demo` | `medium` plus HA resource wiring for VM 100. |
+| `broken-storage` | `small` with `local-lvm` offline / simulated I/O error. |
+| `demo-cluster` | Large UI-oriented enterprise dataset (many nodes/guests/Ceph/HA/history). Prefer loading via the Web UI demo controls. |
+
+## Examples
+
+```bash
+make seed PROFILE=small
+make seed PROFILE=medium
+make seed PROFILE=ha-demo
+make seed PROFILE=broken-storage
+make seed PROFILE=large
+```
+
+## Demo cluster via UI
+
+The interactive console can load and unload the demo dataset:
+
+- `POST /ui/api/demo/load`
+- `POST /ui/api/demo/unload` — wipes API-created state then loads `minimal`
+- `GET /ui/api/demo/state`
+
+These UI helper endpoints are development-oriented and are not separately
+authenticated today. Treat them as lab controls only.
+
+## Reseed vs client state
+
+Terraform, Pulumi, and Ansible may still hold resource state after a reseed.
+Refresh or destroy/recreate external state after replacing the PostgreSQL
+simulation contents. See [Operations](operations.md) and client cookbooks.