Milestone 2: module/model docs (MD, Sphinx RST, PDF) and work log

74 source modules documented with extracted signatures, JSDoc params,
imports, and call graphs. 10 first-class models (PriceRule through
StatusResponse) have their own MD/RST/PDF. Sphinx HTML builds from
docs/sphinx. Per-module PDFs in docs/modules-pdf and docs/models-pdf.

Middleware gates 2–6 and 10 pass on MOCK_VERAE without NATS.

Learned: RST includes are relative to the RST file; keep one PDF per
module; Add Numbers remains the only push required tomorrow.

docs/sphinx/modules/verae-zapier-middleware/store/tenants.md

@@ -0,0 +1,70 @@
+# `verae-zapier-middleware/store/tenants`
+
+**Package:** `verae-zapier-middleware`  
+**Source:** `packages/verae-zapier-middleware/src/store/tenants.js`  
+**Lines:** 138
+
+## What this module is
+
+Implementation module in `verae-zapier-middleware`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`getTenant`, `getTenantByApiKey`, `listTenants`, `upsertTenant`, `createTenant`, `resolveLimits`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `getTenant` | `tenantId` | tenantId: `string` | `Tenant|null` | see Call graph |
+| `getTenantByApiKey` | `apiKey` | apiKey: `string` | `Tenant|null` | see Call graph |
+| `listTenants` | `(none)` | — | `Tenant[]` | see Call graph |
+| `upsertTenant` | `tenant` | tenant: `Tenant` | `Tenant` | see Call graph |
+| `createTenant` | `{
+  id,
+  name,
+  plan = 'free',
+  veraeUsername,
+  veraePassword,
+  contract = null,
+  apiKey = generateApiKey(` | params: `object`, params.id: `string`, params.name: `string`, params.plan: `string`, params.veraeUsername: `string`, params.veraePassword: `string`, params.contract: `object|null`, params.apiKey: `string`, params.metadata: `object` | `{ tenant: Tenant, apiKey: string ` — } | see Call graph |
+| `resolveLimits` | `tenant` | tenant: `Tenant` | `{
+ *   timestamps: number|null,
+ *   verifications: number|null,
+ *   batch: boolean,
+ *   batchMaxItems: number|null,
+ *   requestsPerMinute: number,
+ *   allowOverage: boolean,
+ *   overageRates: object
+ * ` — } | see Call graph |
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `persist` | `(none)` |
+| `persist` | `(none)` |
+
+## What it imports / requires
+
+- `./db.js`
+- `../lib/tokens.js`
+- `../config.js`
+- `../debug/logger.js`
+
+## Call graph (identifiers invoked)
+
+`createDebugger`, `getTenant`, `getStore`, `getTenantByApiKey`, `listTenants`, `values`, `upsertTenant`, `persist`, `debug`, `createTenant`, `generateApiKey`, `toISOString`, `info`, `tenant`, `resolveLimits`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+