Sync docs, add verae-bootstrap, and run the full stack on NS1.

Docs match current modules: public portal is access-web /portal/,
IAM and keep are listed, edge is loopback. Bootstrap clones every
Forgejo repo and installs deps per server type. Fleet starts IAM
and staff-session. NS1 all-in-one uses edge :13000 because :3000
is taken; archive workers stay with keep.

packages/verae-bootstrap/scripts/test.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+test -f "$ROOT/repos.txt"
+test -f "$ROOT/types/ns1-all-in-one/repos.txt"
+test -f "$ROOT/types/control-plane/repos.txt"
+test -f "$ROOT/types/ns1-archive/repos.txt"
+test -f "$ROOT/types/lan-worker/repos.txt"
+# every type list is a subset of the master list
+while read -r name; do
+  [[ -z "$name" || "$name" == \#* ]] && continue
+  grep -qx "$name" "$ROOT/repos.txt" || { echo "type repo not in master: $name" >&2; exit 1; }
+done < <(cat "$ROOT"/types/*/repos.txt)
+echo OK