Initial commit: VMware vSphere API simulator scaffold.

Add the FastAPI app, PostgreSQL migrations, Docker/Helm packaging, API
contracts, docs, client examples, and the unit/integration/compatibility
test suite for local client and tooling labs without a real vCenter.

docs/domains/session.md

@@ -0,0 +1,31 @@
+**Language / Язык:** [English](session.md) | [Русский](../ru/domains/session.md)
+
+# Session
+
+Durable session identity shared by REST and SOAP:
+[`app/vsphere/security/session.py`](../../app/vsphere/security/session.py).
+
+## Endpoints
+
+| Method | Path | Notes |
+|---|---|---|
+| POST | `/api/session` | Basic auth → JSON string session id + `vmware-api-session-id` header/cookie |
+| GET | `/api/session` | HTTP 200; `x-vmware-session-user` / `x-vmware-session-roles` headers |
+| DELETE | `/api/session` | Invalidates the session, clears cookie |
+| POST/GET/DELETE | `/rest/com/vmware/cis/session` | Legacy `{ "value": … }` equivalents |
+| POST | SOAP `SessionManager.Login` | Returns the same session id; sets `vmware_soap_session` cookie |
+| POST | SOAP `SessionManager.Logout` | Deletes the session |
+
+## Highlights
+
+- Sessions are opaque 32-char hex tokens stored in `vsphere_sessions` with a
+  **2-hour sliding TTL** — every authenticated call extends `expires_at`.
+- The four lab credentials (`vsphere_credentials`, scrypt-hashed) are
+  idempotently ensured on first login and by every seed profile
+  (`ensure_default_credentials`).
+- `require_session` resolves the session from either the
+  `vmware-api-session-id` header or cookie; missing/expired → HTTP 401.
+- Roles are attached to the session at lookup time
+  (`vsphere_credentials.roles`) and drive [Authorization](authz.md).
+
+See [Authentication](../authentication.md) for full request examples.