Initial commit: VMware vSphere API simulator scaffold.

Add the FastAPI app, PostgreSQL migrations, Docker/Helm packaging, API
contracts, docs, client examples, and the unit/integration/compatibility
test suite for local client and tooling labs without a real vCenter.

docs/faq.md

@@ -0,0 +1,57 @@
+**Language / Язык:** [English](faq.md) | [Русский](ru/faq.md)
+
+# FAQ
+
+## Is this a real vCenter / ESXi?
+
+No. It is an API and state simulator. Hosts, VMs, datastores, and networks
+are durable PostgreSQL models, not ESXi hosts or KVM/vmkernel processes.
+
+## Do you really cover the vSphere Automation API?
+
+The **runtime** always serves the full registered route table (1077 routes:
+104 deep handlers + a DB-backed stub surface for the rest) — see
+[API surface](api-surface.md). The **catalog** majors 6–8 are intentionally
+low-coverage historical floors (2.9%–9.6%); only major 9 (8.0 U2 / Automation
+9.1 surface) is declared 100% in the catalog. See
+[API versions](api-versions.md) and [Compatibility](compatibility.md).
+
+## Can I use this in CI for Terraform / Ansible / pyvmomi / custom clients?
+
+Yes. That is a primary use case. Seed a profile and point clients at the
+HTTPS gateway `:443` (REST `/api`/`/rest` or SOAP `/sdk`). See
+[Clients](clients.md).
+
+## Why do some NSX / Supervisor / vSAN / SAML calls "succeed" without remotes?
+
+Those areas persist **local, seeded** simulator state (see the "Platform
+surfaces" table in [API coverage](api-coverage.md)). They intentionally do
+not call a real NSX Manager, Tanzu Supervisor, or IdP.
+
+## Does registry coverage mean perfect vSphere parity?
+
+It means every registered route has a durable handler or DB-backed stub and
+is subject to the project's verification suites. Exact edge-case parity with
+a physical ESXi cluster can still differ; use `/ui/api/compatibility` and
+your own client tests for certification claims.
+
+## Where is the Web UI?
+
+[https://localhost/](https://localhost/) after `make up` (gateway).
+
+## Can I deploy on Kubernetes?
+
+Yes. Use the Helm chart under `helm/vmware-api-simulator` with the published
+Hub image. Ingress + cert-manager Let's Encrypt is supported — see
+[Kubernetes / Helm](kubernetes.md).
+
+## What is `ENABLE_PVE_STUB`?
+
+An optional, off-by-default legacy Proxmox VE `/api2/*` stub plane inherited
+from a shared platform lineage. Native vSphere REST/SOAP is always on and is
+the primary surface of this project regardless of this flag.
+
+## Which VMs does the `small` seed use?
+
+`web-01`, `web-02`, `db-01`, `app-01`, `jumpbox` — see
+[Seed profiles](seed-profiles.md).