Bind each customer to a Verae userId for hop tracing

Signup registers/binds a Verae central user and stores veraeUserId. Public access stays the zappier API key. Chain JWTs stay server-side behind tokenRef. Authz, billing, and jobs.watch carry veraeUserId.

docs/sphinx/modules/verae-zapier-middleware/clients/veraeClient.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-zapier-middleware`  
 **Source:** `packages/verae-zapier-middleware/src/clients/veraeClient.js`  
-**Lines:** 352
+**Lines:** 386
 
 ## What this module is
 
@@ -24,6 +24,7 @@ _None extracted._
 | `delay` | `ms` | ms: `number` | `Promise<void>` | see Call graph |
 | `mockLogin` | `{ username, password }` | ms: `number` | `Promise<void>` | see Call graph |
 | `mockValidate` | `token` | — | `unknown` | see Call graph |
+| `mockCreateUser` | `{ username, password, role = 'user' }` | — | `unknown` | see Call graph |
 | `mockCreateTimestamp` | `{ data, hashAlg, sha256, publicMetadata, privateMetadata }` | — | `unknown` | see Call graph |
 | `mockGetStatus` | `jobId` | — | `unknown` | see Call graph |
 | `mockLookupHash` | `sha256` | — | `unknown` | see Call graph |
@@ -38,6 +39,8 @@ _None extracted._
 | `setTimeout` | `(` |
 | `login` | `credentials` |
 | `validate` | `token` |
+| `createUser` | `adminToken, body` |
+| `bindUser` | `credentials` |
 | `createTimestamp` | `token, body` |
 | `lookupHash` | `token, sha256` |
 | `createBatchTimestamp` | `token, body` |
@@ -54,10 +57,11 @@ _None extracted._
 - `../config.js`
 - `../errors.js`
 - `../debug/logger.js`
+- `../lib/identity.js`
 
 ## Call graph (identifiers invoked)
 
-`net`, `createDebugger`, `sha256Hex`, `createHash`, `update`, `digest`, `delay`, `setTimeout`, `mockLogin`, `now`, `toISOString`, `randomUUID`, `includes`, `mockValidate`, `startsWith`, `replace`, `mockCreateTimestamp`, `toLowerCase`, `get`, `set`, `mockGetStatus`, `mockLookupHash`, `mockVerify`, `request`, `debug`, `fetch`, `stringify`, `text`, `parse`, `error`, `client`, `login`, `validate`, `createTimestamp`, `lookupHash`, `createBatchTimestamp`, `push`, `getStatus`, `encodeURIComponent`, `getBatchStatus`, `verify`, `verifyBatch`, `getJobVerification`, `waitForJob`, `jobs`, `clearMockJobs`, `clear`
+`net`, `createDebugger`, `sha256Hex`, `createHash`, `update`, `digest`, `delay`, `setTimeout`, `mockLogin`, `now`, `toISOString`, `stableVeraeUserId`, `includes`, `mockValidate`, `startsWith`, `replace`, `mockCreateUser`, `mockCreateTimestamp`, `toLowerCase`, `get`, `randomUUID`, `set`, `mockGetStatus`, `mockLookupHash`, `mockVerify`, `request`, `debug`, `fetch`, `stringify`, `text`, `parse`, `error`, `client`, `login`, `validate`, `createUser`, `bindUser`, `createTimestamp`, `lookupHash`, `createBatchTimestamp`, `push`, `getStatus`, `encodeURIComponent`, `getBatchStatus`, `verify`, `verifyBatch`, `getJobVerification`, `waitForJob`, `jobs`, `clearMockJobs`, `clear`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.