Initial commit: VMware vSphere API simulator scaffold.

Add the FastAPI app, PostgreSQL migrations, Docker/Helm packaging, API
contracts, docs, client examples, and the unit/integration/compatibility
test suite for local client and tooling labs without a real vCenter.

docs/security.md

@@ -0,0 +1,54 @@
+**Language / Язык:** [English](security.md) | [Русский](ru/security.md)
+
+# Security
+
+## Lab threat model
+
+This project is a **local / CI laboratory simulator**. It is not hardened as
+a multi-tenant public vCenter service. Default credentials, UI demo controls,
+and compatibility endpoints are convenient for development and intentionally
+open in the default Compose stack.
+
+Do not expose ports `443` / `80` to untrusted networks without additional
+controls you supply yourself.
+
+## Credentials and secrets
+
+- Passwords are stored as scrypt hashes (`vsphere_credentials.password_hash`).
+- Session ids are opaque tokens (`vmware-api-session-id`) with a 2-hour
+  sliding expiry, tracked in PostgreSQL (`vsphere_sessions`).
+- Logs redact recognized session-id and password representations.
+- Content library update/download session responses expose upload/download
+  endpoints, not raw secrets.
+
+Change `TICKET_SIGNING_KEY` for any shared lab. Replace seeded passwords
+before demoing to others.
+
+## TLS materials
+
+`docker/tls/` contains a checked-in self-signed certificate for the local
+`api-gateway` nginx service. It exists so unmodified TLS clients (pyvmomi,
+govmomi, Terraform's `hashicorp/vsphere` provider) can connect with
+`insecure`/`verify=False` set. **Never** reuse these files in production.
+
+## Simulator administration
+
+There is currently **no** separately authenticated admin control plane. Web
+UI helper routes under `/ui/api/*` are available whenever the process is
+reachable — including reseed and hot-swap actions. Treat network exposure as
+the trust boundary.
+
+## Authorization
+
+Mutating REST endpoints check role-derived privileges
+(`app/vsphere/security/authz.py`) before touching inventory. The seeded
+`readonly@vsphere.local` principal cannot power on/create/delete VMs (HTTP
+403). See [Authorization](domains/authz.md).
+
+## Simulated remotes
+
+NSX/Supervisor/vSAN/SAML-OIDC/VECS-certificate stand-ins (see
+[API coverage](api-coverage.md)) persist local simulator state only. They do
+not open real connections to external IdPs, NSX Manager, or a live vSAN
+cluster. Do not rely on the simulator for testing live credential
+exfiltration defenses against real providers.