Add a stateful Proxmox API console and broad handler coverage beyond the

initial QEMU slice, backed by imported contracts for majors 6–9.
- Implement durable handlers for access/auth, cluster, LXC, storage, HA,
  firewall, Ceph, SDN, ACME, notifications, pools, mapping, and node ops
- Serve an interactive Web UI with catalog browsing, demo seed controls,
  and OpenAPI/help surfaces
- Bundle PVE 6.4-15, 7.4-16, and 8.4.5 contract revisions alongside 9.2.3
- Support in-memory runtime contract Apply (POST /ui/api/contract/apply)
  so /version and /api2 routes follow the selected major until restart
- Expand seed profiles (including demo-cluster), migrations 007–008, TLS
  gateway config, Compose/Makefile tooling, and compatibility evidence
- Tighten .gitignore for macOS, hidden directories (.*/), and local secrets

tests/unit/test_contract_importer.py

@@ -6,7 +6,11 @@ from pathlib import Path
 import httpx
 import pytest
 
-from app.contracts.importer import RemoteSourceImporter, validate_remote_url
+from app.contracts.importer import (
+    RemoteSourceImporter,
+    validate_public_addresses,
+    validate_remote_url,
+)
 from app.contracts.normalize import normalize_snapshot
 from app.contracts.source import ApiViewerParser, SourceError
 from app.contracts.store import RevisionStore
@@ -31,6 +35,17 @@ def test_remote_url_policy_rejects_unsafe_urls(url: str) -> None:
         validate_remote_url(url, frozenset({"pve.proxmox.com"}))
 
 
+@pytest.mark.parametrize(
+    "address",
+    [
+        "198.18.0.42",
+        "::ffff:198.18.0.42",
+    ],
+)
+def test_validate_public_addresses_allows_proxy_fake_ip(address: str) -> None:
+    validate_public_addresses((address,))
+
+
 async def test_remote_import_rejects_private_resolution() -> None:
     async def private_resolver(_host: str) -> tuple[str, ...]:
         return ("127.0.0.1",)