docs: Infrastructure as Code (Pulumi) page + landing feature

apps/docs/content/docs/core/iac.mdx

@@ -0,0 +1,83 @@
+---
+title: Infrastructure as Code
+description: "Manage nomploy services as code with Pulumi — declare projects, applications, databases, domains and compose stacks and deploy them over the REST API."
+---
+
+import { Callout } from "fumadocs-ui/components/callout";
+
+Everything nomploy exposes in the panel is also available over its **REST API**
+(the tRPC router set, served at `<endpoint>/api/<router>.<procedure>` with an
+`x-api-key` header). On top of that there's a **Pulumi provider** so you can manage
+your services **as code** instead of clicking through the UI.
+
+- **Repo:** [github.com/Nomploy/pulumi-nomploy](https://github.com/Nomploy/pulumi-nomploy)
+
+<Callout type="info">
+It's a TypeScript **dynamic provider** over the REST API — no separate API layer
+and no Go toolchain. Prototype status: resources are complete and type-checked;
+APIs may still change.
+</Callout>
+
+## Resources
+
+| Resource | What it manages |
+|---|---|
+| `Project` | A project (auto-creates its production environment; exposes `environmentId`). |
+| `Application` | An app, with a **Docker image** or **generic git** source and optional `deploy`. |
+| `Postgres` / `Mysql` / `Mariadb` / `Mongo` / `Redis` | A managed database, with optional `deploy`. |
+| `Compose` | A compose service — raw compose file or a Nomad Pack. |
+| `Domain` | A domain routed to an application or compose service. |
+
+## Quick start
+
+```bash
+git clone https://github.com/Nomploy/pulumi-nomploy
+cd pulumi-nomploy
+npm install
+
+pulumi login --local
+pulumi stack init dev
+pulumi config set endpoint https://your-nomploy-instance.com
+pulumi config set apiKey     <your-x-api-key>  --secret
+pulumi config set dbPassword <postgres-pass>   --secret
+
+pulumi up        # project → database + application(+deploy) → domain
+pulumi destroy   # tear it down
+```
+
+Mint an API key in the panel under **Settings → API / Swagger**.
+
+## Example
+
+```ts
+import * as pulumi from "@pulumi/pulumi";
+import * as nomploy from "pulumi-nomploy/src/nomploy";
+
+const conn = {
+  endpoint: "https://your-nomploy-instance.com",
+  apiKey: new pulumi.Config().requireSecret("apiKey"),
+};
+
+const project = new nomploy.Project("web", { ...conn, name: "web" });
+
+new nomploy.Application("api", {
+  ...conn,
+  name: "api",
+  environmentId: project.environmentId,
+  dockerImage: "ghcr.io/you/api:latest", // or gitUrl / gitBranch / buildType
+  deploy: true,
+});
+
+new nomploy.Postgres("db", {
+  ...conn,
+  name: "db",
+  environmentId: project.environmentId,
+  databaseName: "app",
+  databaseUser: "app",
+  databasePassword: new pulumi.Config().requireSecret("dbPassword"),
+  deploy: true,
+});
+```
+
+See the repo's README for the full resource reference, the generated typed API
+client, and notes (database node placement, synchronous deploys, and more).

apps/docs/content/docs/core/meta.json

@@ -40,6 +40,7 @@
 		"---Services---",
 		"overview",
 		"deploying",
+		"iac",
 		"variables",
 		"domains",
 		"applications",

apps/website/components/first-features.tsx

@@ -14,6 +14,7 @@ import {
 	Activity,
 	Boxes,
 	Cpu,
+	FileCode,
 	Layers,
 	LineChart,
 	Network,
@@ -97,6 +98,12 @@ export function FirstFeaturesSection() {
 				"Ship cluster metrics and logs to any OTLP backend (SigNoz, Grafana, Datadog) with service auto-discovery from the Consul catalog.",
 			icon: <Activity />,
 		},
+		{
+			title: "Infrastructure as Code",
+			description:
+				"Manage your services as code with the Pulumi provider — declare projects, apps, databases and domains and deploy them over the REST API.",
+			icon: <FileCode />,
+		},
 		{
 			title: "GPU Scheduling",
 			description: