Milestone 3: NATS wait (gate 9), hash lookup, zappier timestamp, NS1 tunnel

Wait-via-NATS returns completed or pending+jobId (GATE 9). Mock SHA256
idempotent register + GET /hashes/{sha256}. Zappier commercial edge has
POST /v1/timestamp and hash-lookup. GATE 12 smoke (signup + wait) passes.

NS1 NATS is 127.0.0.1:4222 on 70.88.205.138; SSH tunnel :14222. Local
nats-server -js used for isolated tests. Activate app adds Echo Text.

Learned: JetStream on NS1 is loopback-only; do not bind 4222 public.

packages/zappier/openapi.yaml

@@ -58,6 +58,41 @@ paths:
       responses:
         '200':
           description: OK
+  /v1/timestamp:
+    post:
+      operationId: timestamp
+      summary: Register a timestamp (proxies middleware or in-process mock)
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                data:
+                  type: string
+                sha256:
+                  type: string
+                hashAlg:
+                  type: string
+      responses:
+        '202':
+          description: Accepted
+  /v1/hashes/{sha256}:
+    get:
+      operationId: hash-lookup
+      summary: Lookup a SHA256 timestamp (mock)
+      parameters:
+        - name: sha256
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: OK
+        '404':
+          description: Missing
   /v1/add:
     post:
       operationId: add