Separate Zapier, web, API, and leaf access planes with NATS authz

Zapier is one ingress. Direct web, customer API, and S2S leaf nodes are their own services. Every hop to an internal subject must pass verae.access.authz.check (default deny by plane).

scripts/build-docs-site.py

@@ -75,6 +75,11 @@ SECTIONS = [
             ("packages/zappier-customer-service/README.md", "Customer-service credits API"),
             ("packages/zappier-sales-pricing/README.md", "Sales per-customer pricing API"),
             ("packages/zappier-accounting-export/README.md", "QuickBooks / accounting export"),
+            ("packages/verae-access-authz/README.md", "Access-plane authorization"),
+            ("packages/verae-access-web/README.md", "Direct web access plane"),
+            ("packages/verae-access-api/README.md", "Direct customer API plane"),
+            ("packages/verae-access-leaf/README.md", "S2S NATS leaf plane"),
+            ("packages/verae-access-zapier/README.md", "Zapier-only access plane"),
         ],
     ),
     (
@@ -331,6 +336,11 @@ def main() -> None:
         "zappier-customer-service",
         "zappier-sales-pricing",
         "zappier-accounting-export",
+        "verae-access-authz",
+        "verae-access-web",
+        "verae-access-api",
+        "verae-access-leaf",
+        "verae-access-zapier",
     ):
         pkg_root = ROOT / "packages" / pkg
         if pkg in {"zapier-user-docs", "overview", "docs-master", "verae-ops"}:
@@ -493,6 +503,11 @@ def main() -> None:
         ("zappier-customer-service", "CS credits"),
         ("zappier-sales-pricing", "Sales per-customer pricing"),
         ("zappier-accounting-export", "QuickBooks export"),
+        ("verae-access-authz", "Access-plane authorization"),
+        ("verae-access-web", "Direct web access"),
+        ("verae-access-api", "Direct customer API"),
+        ("verae-access-leaf", "S2S NATS leaf"),
+        ("verae-access-zapier", "Zapier access plane"),
     ]
     git_lis = "".join(
         f'<li><a href="https://git.georgelambert.org/marchon/{name}">{name}</a> '