Initial commit: VMware vSphere API simulator scaffold.

Add the FastAPI app, PostgreSQL migrations, Docker/Helm packaging, API
contracts, docs, client examples, and the unit/integration/compatibility
test suite for local client and tooling labs without a real vCenter.

tests/unit/test_vsphere_profiles.py

@@ -0,0 +1,52 @@
+"""vSphere seed profile shape tests (no database)."""
+
+from app.vsphere.profiles import build_vsphere_profile, large_vsphere_profile, small_vsphere_profile
+from app.vsphere.security.authz import has_privilege, privileges_for_roles
+
+
+def test_small_profile_has_named_vms() -> None:
+    profile = small_vsphere_profile()
+    assert profile.vm_count == 5
+    names = {obj.name for obj in profile.objects if obj.type == "VirtualMachine"}
+    assert {"web-01", "app-01", "db-01"} <= names
+
+
+def test_large_profile_1000_vms() -> None:
+    profile = large_vsphere_profile(host_count=10, vm_count=1000)
+    assert profile.vm_count == 1000
+    assert profile.host_count == 10
+    vms = [obj for obj in profile.objects if obj.type == "VirtualMachine"]
+    hosts = [obj for obj in profile.objects if obj.type == "HostSystem"]
+    assert len(vms) == 1000
+    assert len(hosts) == 10
+    # Named cookbooks survive at the front of large inventories.
+    assert any(obj.name == "web-01" for obj in vms)
+    # Even spread across hosts
+    by_host: dict[str, int] = {}
+    for vm in vms:
+        host = str(vm.props.get("host"))
+        by_host[host] = by_host.get(host, 0) + 1
+    assert len(by_host) == 10
+    assert min(by_host.values()) >= 90
+    assert max(by_host.values()) <= 110
+
+
+def test_demo_cluster_profile() -> None:
+    profile = build_vsphere_profile("demo-cluster")
+    assert profile.vm_count == 1000
+    assert profile.host_count == 20
+
+
+def test_lab_credentials_include_readonly() -> None:
+    users = {c.username: c.roles for c in large_vsphere_profile().credentials}
+    assert "readonly@vsphere.local" in users
+    assert "ReadOnly" in users["readonly@vsphere.local"]
+    assert "Administrator" in users["administrator@vsphere.local"]
+
+
+def test_readonly_cannot_power() -> None:
+    assert has_privilege(["ReadOnly"], "System.Read")
+    assert not has_privilege(["ReadOnly"], "VirtualMachine.Interact.PowerOn")
+    assert has_privilege(["VirtualMachinePowerUser"], "VirtualMachine.Interact.PowerOn")
+    assert "*" not in privileges_for_roles(["Administrator"])
+    assert "Authorization.ModifyPermissions" in privileges_for_roles(["Administrator"])