Add a stateful Proxmox API console and broad handler coverage beyond the

initial QEMU slice, backed by imported contracts for majors 6–9.
- Implement durable handlers for access/auth, cluster, LXC, storage, HA,
  firewall, Ceph, SDN, ACME, notifications, pools, mapping, and node ops
- Serve an interactive Web UI with catalog browsing, demo seed controls,
  and OpenAPI/help surfaces
- Bundle PVE 6.4-15, 7.4-16, and 8.4.5 contract revisions alongside 9.2.3
- Support in-memory runtime contract Apply (POST /ui/api/contract/apply)
  so /version and /api2 routes follow the selected major until restart
- Expand seed profiles (including demo-cluster), migrations 007–008, TLS
  gateway config, Compose/Makefile tooling, and compatibility evidence
- Tighten .gitignore for macOS, hidden directories (.*/), and local secrets

tests/compatibility/test_api_surface_probe.py

@@ -0,0 +1,38 @@
+"""CI gate: every declared method on majors 6-9 is callable without critical failures.
+
+Critical = HTTP 501, server 5xx, unhandled exceptions, or emulator-limitation
+strings. Synthetic 4xx (missing object / incomplete payload) are allowed.
+Requires PostgreSQL via ``TEST_DATABASE_URL``.
+"""
+
+from __future__ import annotations
+
+import os
+
+import pytest
+
+from app.surface_probe import run_probe
+
+pytestmark = [
+    pytest.mark.integration,
+    pytest.mark.skipif(not os.getenv("TEST_DATABASE_URL"), reason="TEST_DATABASE_URL is required"),
+]
+
+
+@pytest.mark.asyncio
+async def test_all_majors_surface_has_zero_critical_failures() -> None:
+    results = await run_probe()
+    assert len(results) == 4
+    for item in results:
+        version = item["version"]
+        declared = item["declared"]
+        assert item["implemented"] == declared, version
+        assert item["verified"] == declared, version
+        assert item["dimensions_min"] == declared, version
+        assert item["failure_count"] == 0, f"{version} critical failures: {item.get('failures')}"
+        by_verb = item["by_verb"]
+        for verb, buckets in by_verb.items():
+            assert buckets.get("unimplemented_501", 0) == 0, (version, verb, buckets)
+            assert buckets.get("unsupported_message", 0) == 0, (version, verb, buckets)
+            assert buckets.get("server_5xx", 0) == 0, (version, verb, buckets)
+            assert buckets.get("exception", 0) == 0, (version, verb, buckets)