Adjacent work: PDF receipts, encrypted blob+share mock, NATS tunnel, SHA256 Zapier action

Around remaining blockers (Zapier login, live Verae): generate PDF receipts
without extra deps; AES-256-GCM object store with tenant isolation and share
tokens; scripts/nats-tunnel.sh to NS1; SHA256 Hash Text local Zapier action;
scripts/test-offline.sh for the no-login suite.

Learned: other-tenant object GET is 403; share token is the mock unwrap path.

docs/modules/verae-activate/index.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-activate`  
 **Source:** `packages/verae-activate/index.js`  
-**Lines:** 23
+**Lines:** 25
 
 ## What this module is
 
@@ -10,7 +10,7 @@ Implementation module in `verae-activate`. The tables below are extracted from t
 
 ## Exports
 
-`version`, `platformVersion`, `authentication`, `creates`, `addNumbers`, `echo`
+`version`, `platformVersion`, `authentication`, `creates`, `addNumbers`, `echo`, `sha256Hash`
 
 ## Types / interfaces / classes
 
@@ -25,6 +25,7 @@ _No top-level functions extracted._
 - `./authentication`
 - `./creates/add_numbers`
 - `./creates/echo`
+- `./creates/sha256`
 - `./package.json`
 - `zapier-platform-core`