Sync docs, add verae-bootstrap, and run the full stack on NS1.

Docs match current modules: public portal is access-web /portal/,
IAM and keep are listed, edge is loopback. Bootstrap clones every
Forgejo repo and installs deps per server type. Fleet starts IAM
and staff-session. NS1 all-in-one uses edge :13000 because :3000
is taken; archive workers stay with keep.

packages/verae-bootstrap/scripts/clone.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Clone Forgejo modules listed in a repos file.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+GITSSH="${GITSSH:-ssh://git@git.georgelambert.org:2223/marchon}"
+DEST="${VERAE_SRC:-$HOME/verae-src}"
+LIST="${1:-$ROOT/repos.txt}"
+export GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o StrictHostKeyChecking=accept-new -p 2223}"
+mkdir -p "$DEST"
+while read -r name; do
+  [[ -z "$name" || "$name" == \#* ]] && continue
+  if [[ -d "$DEST/$name/.git" ]]; then
+    echo "fetch $name"
+    git -C "$DEST/$name" fetch --prune origin
+    git -C "$DEST/$name" checkout -q main 2>/dev/null || git -C "$DEST/$name" checkout -q master
+    git -C "$DEST/$name" pull --ff-only || true
+  else
+    echo "clone $name"
+    git clone "$GITSSH/${name}.git" "$DEST/$name"
+  fi
+done < "$LIST"
+echo "cloned into $DEST"