Milestone 3: NATS wait (gate 9), hash lookup, zappier timestamp, NS1 tunnel

Wait-via-NATS returns completed or pending+jobId (GATE 9). Mock SHA256
idempotent register + GET /hashes/{sha256}. Zappier commercial edge has
POST /v1/timestamp and hash-lookup. GATE 12 smoke (signup + wait) passes.

NS1 NATS is 127.0.0.1:4222 on 70.88.205.138; SSH tunnel :14222. Local
nats-server -js used for isolated tests. Activate app adds Echo Text.

Learned: JetStream on NS1 is loopback-only; do not bind 4222 public.

docs/sphinx/modules/verae-zapier-middleware/routes/hashRoutes.md

@@ -0,0 +1,46 @@
+# `verae-zapier-middleware/routes/hashRoutes`
+
+**Package:** `verae-zapier-middleware`  
+**Source:** `packages/verae-zapier-middleware/src/routes/hashRoutes.js`  
+**Lines:** 22
+
+## What this module is
+
+Implementation module in `verae-zapier-middleware`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`hashRoutes`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+_No top-level functions extracted._
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `asyncHandler` | `async (req, res` |
+
+## What it imports / requires
+
+- `express`
+- `../errors.js`
+- `../services/timestampService.js`
+
+## Call graph (identifiers invoked)
+
+`get`, `asyncHandler`, `async`, `test`, `lookupHash`, `json`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+