Sync docs, add verae-bootstrap, and run the full stack on NS1.

Docs match current modules: public portal is access-web /portal/,
IAM and keep are listed, edge is loopback. Bootstrap clones every
Forgejo repo and installs deps per server type. Fleet starts IAM
and staff-session. NS1 all-in-one uses edge :13000 because :3000
is taken; archive workers stay with keep.

packages/verae-fleet/README.md

@@ -39,6 +39,8 @@ Operator console (Fleet · Trace · Docs) at http://127.0.0.1:3850/ — [docs/CO
 
 Zapier cloud apps are listed but **not spawned**. NATS on NS1 is **monitored only** (loopback `:4222`, never a public bind).
 
+On a dedicated host, run **[verae-keep](https://git.georgelambert.org/marchon/verae-keep)** next to fleet: keep restarts crashed replicas unless this console paused or stopped them (`intent.json` per instance). Pause/stop/start write that file locally and over SSH.
+
 Install on Docker / Proxmox / metal: https://zapier.georgelambert.org/packages/verae-ops/README.pdf
 
 Clone: `ssh://git@git.georgelambert.org:2223/marchon/verae-fleet.git`

packages/verae-fleet/fleet.json

@@ -33,6 +33,8 @@
     "archive-aggregator": { "min": 1, "max": 2, "keepFloor": true, "enabled": true },
     "archive-worm": { "min": 3, "max": 6, "keepFloor": true, "enabled": true },
     "tree-node": { "min": 3, "max": 9, "keepFloor": true, "enabled": true },
-    "zapier-simulator": { "min": 0, "max": 1, "keepFloor": false, "enabled": true }
+    "zapier-simulator": { "min": 0, "max": 1, "keepFloor": false, "enabled": true },
+    "staff-iam": { "min": 1, "max": 1, "keepFloor": true, "enabled": true },
+    "staff-session": { "min": 1, "max": 1, "keepFloor": true, "enabled": true }
   }
 }

packages/verae-fleet/services/staff-session.json

@@ -0,0 +1,21 @@
+{
+  "id": "staff-session",
+  "title": "Staff session cookie (proxies IAM when STAFF_IAM_URL set)",
+  "kind": "http",
+  "package": "verae-staff-session",
+  "role": "staff-session",
+  "managed": true,
+  "runtime": "HTTP :3027",
+  "health": { "type": "http", "path": "/health", "timeoutMs": 2000 },
+  "ports": { "healthBase": 3027 },
+  "spawn": {
+    "cwd": "../verae-staff-session",
+    "command": "node",
+    "args": ["src/server.js"]
+  },
+  "env": {
+    "PORT": "3027",
+    "STAFF_IAM_URL": "http://127.0.0.1:3028"
+  },
+  "nats": { "in": [], "out": [] }
+}