Initial commit: VMware vSphere API simulator scaffold.

Add the FastAPI app, PostgreSQL migrations, Docker/Helm packaging, API
contracts, docs, client examples, and the unit/integration/compatibility
test suite for local client and tooling labs without a real vCenter.

app/vsphere/rest/version_gate.py

@@ -0,0 +1,29 @@
+"""HTTP middleware: resolve registered Automation API surface (lab: no version 501).
+
+Historically this returned HTTP 501 when the hot-swapped catalog major was below
+a path's PATH_FLOOR. That blocked real lab data for Ansible/Terraform/apps.
+Catalog majors still filter the UI browse list; runtime always serves registered
+routes with deep handlers or DB-backed stubs.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.requests import Request
+from starlette.responses import Response
+
+from app.vsphere.contracts.matrix import available_for_request
+
+
+class VsphereVersionGateMiddleware(BaseHTTPMiddleware):
+    async def dispatch(self, request: Request, call_next: Callable) -> Response:
+        path = request.url.path
+        if not (path.startswith("/api/") or path.startswith("/rest/")):
+            return await call_next(request)
+        major = getattr(request.app.state, "vsphere_contract_major", 9)
+        # Touch resolver so unknown paths still fall through to FastAPI 404 /
+        # stub catch-all; registered paths are never version-blocked.
+        available_for_request(request.method, path, int(major))
+        return await call_next(request)