Adjacent work: PDF receipts, encrypted blob+share mock, NATS tunnel, SHA256 Zapier action

Around remaining blockers (Zapier login, live Verae): generate PDF receipts
without extra deps; AES-256-GCM object store with tenant isolation and share
tokens; scripts/nats-tunnel.sh to NS1; SHA256 Hash Text local Zapier action;
scripts/test-offline.sh for the no-login suite.

Learned: other-tenant object GET is 403; share token is the mock unwrap path.

docs/modules/verae-zapier-middleware/routes/objectRoutes.md

@@ -0,0 +1,50 @@
+# `verae-zapier-middleware/routes/objectRoutes`
+
+**Package:** `verae-zapier-middleware`  
+**Source:** `packages/verae-zapier-middleware/src/routes/objectRoutes.js`  
+**Lines:** 91
+
+## What this module is
+
+Implementation module in `verae-zapier-middleware`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`objectRoutes`, `publicShareRoutes`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+_No top-level functions extracted._
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `asyncHandler` | `async (req, res` |
+| `asyncHandler` | `async (req, res` |
+| `asyncHandler` | `async (req, res` |
+| `asyncHandler` | `async (req, res` |
+
+## What it imports / requires
+
+- `express`
+- `../errors.js`
+- `../store/blobs.js`
+- `../services/timestampService.js`
+
+## Call graph (identifiers invoked)
+
+`post`, `asyncHandler`, `async`, `from`, `createTimestamp`, `toString`, `slice`, `putBlob`, `status`, `json`, `get`, `readBlobPlaintext`, `createShare`, `redeemShare`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+