Sync docs, add verae-bootstrap, and run the full stack on NS1.

Docs match current modules: public portal is access-web /portal/,
IAM and keep are listed, edge is loopback. Bootstrap clones every
Forgejo repo and installs deps per server type. Fleet starts IAM
and staff-session. NS1 all-in-one uses edge :13000 because :3000
is taken; archive workers stay with keep.

packages/overview/10-docs-sync.md

@@ -0,0 +1,29 @@
+# Documentation sync (2026-09-11)
+
+Validated against the module list in `packages/` and Forgejo repos.
+
+## Current public doors
+
+| Door | Bind | Notes |
+|------|------|--------|
+| Customer portal | access-web `:3021/portal/` | Static + `/portal/api` → loopback edge |
+| Customer API | access-api `:3022` | |
+| S2S leaf | access-leaf `:3023` | No billing subjects |
+| Zapier | access-zapier `:3024` | Only Zapier HTTPS |
+| Staff plane | access-staff `:3025` | After IAM |
+| zappier-edge | loopback `:3000` (NS1 all-in-one `:13000`) | Admin, Stripe, not a public portal |
+| Operator console | fleet `:3850` on `0.0.0.0` | Pause/stop honored by keep |
+| Staff IAM | `:3028` | Named users, roles, sessions |
+| Keep | `:3860` + watch `:3861` + `guard.sh` | Restart unless paused/stopped |
+
+## New modules since the last catalog pass
+
+- `verae-staff-iam`, `verae-staff-session`, `verae-staff-ui`
+- `verae-keep`
+- `verae-bootstrap` (clone + npm per server type)
+
+## Still blocked (not closable here)
+
+- Live `api.veraetime.net` (`MOCK_VERAE=false`)
+- NATS nkeys/mTLS three-node cluster
+- Zapier Platform `push`