Sync docs, add verae-bootstrap, and run the full stack on NS1.

Docs match current modules: public portal is access-web /portal/,
IAM and keep are listed, edge is loopback. Bootstrap clones every
Forgejo repo and installs deps per server type. Fleet starts IAM
and staff-session. NS1 all-in-one uses edge :13000 because :3000
is taken; archive workers stay with keep.

packages/verae-fleet/services/staff-session.json

@@ -0,0 +1,21 @@
+{
+  "id": "staff-session",
+  "title": "Staff session cookie (proxies IAM when STAFF_IAM_URL set)",
+  "kind": "http",
+  "package": "verae-staff-session",
+  "role": "staff-session",
+  "managed": true,
+  "runtime": "HTTP :3027",
+  "health": { "type": "http", "path": "/health", "timeoutMs": 2000 },
+  "ports": { "healthBase": 3027 },
+  "spawn": {
+    "cwd": "../verae-staff-session",
+    "command": "node",
+    "args": ["src/server.js"]
+  },
+  "env": {
+    "PORT": "3027",
+    "STAFF_IAM_URL": "http://127.0.0.1:3028"
+  },
+  "nats": { "in": [], "out": [] }
+}