Keep-going: tree shares, health flags, CI, compose, timestamp Zapier action

Directory-tree encrypted share mock; /health reports mockVerae/nats;
middleware OpenAPI extended; zappier receipt by jobId; activate Create
Timestamp (local mock or hosted); GitHub Actions test:offline; compose
builds zappier image; seed-demo.mjs.

No Zapier login or live Verae required.

docs/api/middleware-openapi.yaml

@@ -72,6 +72,63 @@ paths:
       responses:
         '200':
           description: Unsubscribed
+  /zapier/v1/hashes/{sha256}:
+    get:
+      summary: Lookup timestamp by SHA256 (mock)
+      operationId: lookupHash
+      security:
+        - BearerAuth: []
+      parameters:
+        - name: sha256
+          in: path
+          required: true
+          schema: { type: string }
+      responses:
+        '200': { description: Found }
+        '404': { description: Missing }
+  /zapier/v1/receipts/{jobId}:
+    get:
+      summary: Certified retrieval receipt (json or pdf)
+      operationId: getReceipt
+      security:
+        - BearerAuth: []
+      parameters:
+        - name: jobId
+          in: path
+          required: true
+          schema: { type: string }
+        - name: format
+          in: query
+          schema: { type: string, enum: [json, pdf] }
+      responses:
+        '200': { description: Receipt }
+  /zapier/v1/objects:
+    post:
+      summary: Store encrypted blob and timestamp
+      operationId: putObject
+      security:
+        - BearerAuth: []
+      responses:
+        '201': { description: Stored }
+  /zapier/v1/objects/trees:
+    post:
+      summary: Store encrypted directory tree
+      operationId: putTree
+      security:
+        - BearerAuth: []
+      responses:
+        '201': { description: Stored }
+  /zapier/v1/shares/{token}:
+    get:
+      summary: Redeem a share token
+      operationId: redeemShare
+      parameters:
+        - name: token
+          in: path
+          required: true
+          schema: { type: string }
+      responses:
+        '200': { description: Ciphertext + dek (mock) }
 components:
   securitySchemes:
     BearerAuth: