Milestone 3: NATS wait (gate 9), hash lookup, zappier timestamp, NS1 tunnel

Wait-via-NATS returns completed or pending+jobId (GATE 9). Mock SHA256
idempotent register + GET /hashes/{sha256}. Zappier commercial edge has
POST /v1/timestamp and hash-lookup. GATE 12 smoke (signup + wait) passes.

NS1 NATS is 127.0.0.1:4222 on 70.88.205.138; SSH tunnel :14222. Local
nats-server -js used for isolated tests. Activate app adds Echo Text.

Learned: JetStream on NS1 is loopback-only; do not bind 4222 public.

docs/modules/verae-zapier/searches/hash_lookup.md

@@ -0,0 +1,41 @@
+# `verae-zapier/searches/hash_lookup`
+
+**Package:** `verae-zapier`  
+**Source:** `packages/verae-zapier/searches/hash_lookup.js`  
+**Lines:** 35
+
+## What this module is
+
+Implementation module in `verae-zapier`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`key`, `noun`, `display`, `label`, `description`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `base` | `(none)` | — | `unknown` | see Call graph |
+| `perform` | `z, bundle` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+_No imports detected._
+
+## Call graph (identifiers invoked)
+
+`async`, `request`, `base`, `encodeURIComponent`, `digest`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+