Sync docs, add verae-bootstrap, and run the full stack on NS1.

Docs match current modules: public portal is access-web /portal/,
IAM and keep are listed, edge is loopback. Bootstrap clones every
Forgejo repo and installs deps per server type. Fleet starts IAM
and staff-session. NS1 all-in-one uses edge :13000 because :3000
is taken; archive workers stay with keep.

packages/overview/02-modules-and-repos.md

@@ -36,6 +36,8 @@ Each runtime piece is its **own git repo** on Forgejo (`git.georgelambert.org`,
 | **verae-staff-session** | `packages/verae-staff-session` | Shared staff cookie login for department HTML |
 | **verae-staff-ui** | `packages/verae-staff-ui` | Shared staff review HTML (CS + access-staff) |
 | **verae-staff-iam** | `packages/verae-staff-iam` | Internal staff users, roles, permissions, audit |
+| **verae-keep** | `packages/verae-keep` | Host keep-alive + watch + guard (honors admin pause/stop) |
+| **verae-bootstrap** | `packages/verae-bootstrap` | Clone every repo and install deps for each server type |
 | **zapier-docs-master** | `packages/docs-master` | Per-module `SUMMARY.md` + `NATS.md` |
 | **verae-ops** | `packages/verae-ops` | Docker, Proxmox, VMs, dedicated hardware, linking services |
 

packages/overview/10-docs-sync.md

@@ -0,0 +1,29 @@
+# Documentation sync (2026-09-11)
+
+Validated against the module list in `packages/` and Forgejo repos.
+
+## Current public doors
+
+| Door | Bind | Notes |
+|------|------|--------|
+| Customer portal | access-web `:3021/portal/` | Static + `/portal/api` → loopback edge |
+| Customer API | access-api `:3022` | |
+| S2S leaf | access-leaf `:3023` | No billing subjects |
+| Zapier | access-zapier `:3024` | Only Zapier HTTPS |
+| Staff plane | access-staff `:3025` | After IAM |
+| zappier-edge | loopback `:3000` (NS1 all-in-one `:13000`) | Admin, Stripe, not a public portal |
+| Operator console | fleet `:3850` on `0.0.0.0` | Pause/stop honored by keep |
+| Staff IAM | `:3028` | Named users, roles, sessions |
+| Keep | `:3860` + watch `:3861` + `guard.sh` | Restart unless paused/stopped |
+
+## New modules since the last catalog pass
+
+- `verae-staff-iam`, `verae-staff-session`, `verae-staff-ui`
+- `verae-keep`
+- `verae-bootstrap` (clone + npm per server type)
+
+## Still blocked (not closable here)
+
+- Live `api.veraetime.net` (`MOCK_VERAE=false`)
+- NATS nkeys/mTLS three-node cluster
+- Zapier Platform `push`