Milestone 3: NATS wait (gate 9), hash lookup, zappier timestamp, NS1 tunnel

Wait-via-NATS returns completed or pending+jobId (GATE 9). Mock SHA256
idempotent register + GET /hashes/{sha256}. Zappier commercial edge has
POST /v1/timestamp and hash-lookup. GATE 12 smoke (signup + wait) passes.

NS1 NATS is 127.0.0.1:4222 on 70.88.205.138; SSH tunnel :14222. Local
nats-server -js used for isolated tests. Activate app adds Echo Text.

Learned: JetStream on NS1 is loopback-only; do not bind 4222 public.

harness/scripts/smoke.sh

@@ -1,10 +1,49 @@
 #!/usr/bin/env bash
-# Disconnected smoke (expand in PR 3 / PR 4).
+# GATE 12 — disconnected E2E: middleware health, signup, timestamp, wait (NATS off).
 set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-echo "workspace: $ROOT"
-curl -fsS "http://127.0.0.1:3100/health" || {
-  echo "middleware /health not up — start packages/verae-zapier-middleware with MOCK_VERAE=true"
-  exit 1
+export MOCK_VERAE=true
+export NATS_ENABLED=false
+export PORT="${PORT:-3100}"
+export TOKEN_SECRET=dev-secret
+cd "$ROOT/packages/verae-zapier-middleware"
+
+started=0
+if ! curl -fsS "http://127.0.0.1:${PORT}/health" >/dev/null 2>&1; then
+  node src/index.js >/tmp/verae-mw-smoke.log 2>&1 &
+  started=$!
+  for i in $(seq 1 40); do
+    if curl -fsS "http://127.0.0.1:${PORT}/health" >/dev/null 2>&1; then
+      break
+    fi
+    sleep 0.15
+  done
+fi
+
+cleanup() {
+  if [[ "$started" != "0" ]]; then
+    kill "$started" 2>/dev/null || true
+  fi
 }
-echo "middleware health ok"
+trap cleanup EXIT
+
+curl -fsS "http://127.0.0.1:${PORT}/health" | grep -q ok
+echo "health ok"
+
+signup=$(curl -fsS -X POST "http://127.0.0.1:${PORT}/zapier/v1/signup" \
+  -H 'content-type: application/json' \
+  -d '{"email":"smoke@example.com","name":"smoke","veraeUsername":"smokeuser","veraePassword":"smokepass"}')
+key=$(node -e "const j=JSON.parse(process.argv[1]); process.stdout.write(j.apiKey||'')" "$signup")
+if [[ -z "$key" ]]; then
+  echo "signup did not return apiKey: $signup" >&2
+  exit 1
+fi
+echo "signup ok"
+
+wait=$(curl -fsS -X POST "http://127.0.0.1:${PORT}/zapier/v1/timestamp/wait" \
+  -H "authorization: Bearer $key" \
+  -H 'content-type: application/json' \
+  -d '{"data":"smoke-payload"}')
+echo "$wait" | grep -q completed
+echo "timestamp wait ok"
+echo "GATE 12 PASSED"