Add a three-node NATS JetStream cluster on distinct Proxmox LXC guests.

LXC 511–513 (nats-a/b/c on 10.10.10.21–23, vmbr1 only) form cluster
verae with replicas=3. Host loopback 127.0.0.1:4222 is unchanged.

packages/overview/02-modules-and-repos.md

@@ -44,6 +44,7 @@ Each runtime piece is its **own git repo** on Forgejo (`git.georgelambert.org`,
 | **verae-backup** | `packages/verae-backup` | SQLite / JetStream / worm+tree snapshots |
 | **verae-deploy** | `packages/verae-deploy` | Tagged checkout + npm ci on the target OS |
 | **verae-proxmox** | `packages/verae-proxmox` | LXC 510 worker on NS1 `vmbr1` |
+| **verae-nats-cluster** | `packages/verae-nats-cluster` | LXC 511–513 JetStream cluster on `vmbr1` |
 
 Libraries that are **not** separate Forgejo apps today: `verae-chain-client` (inside middleware), job-poller and webhook-deliver (middleware workers, fleet-spawned).
 

packages/overview/03-nats-cluster.md

@@ -12,7 +12,13 @@ nats://127.0.0.1:4222,nats://127.0.0.1:4223,nats://127.0.0.1:4224
 
 On a given machine the listener stays on **loopback** (or a private interface). Operators reach it with `scripts/nats-tunnel.sh` / `ssh -L 14222:127.0.0.1:4222`. **Do not bind 4222 on `0.0.0.0` without auth.**
 
-Today’s NS1 box (`NS1.GEORGELAMBERT.ORG`, `70.88.205.138`) already runs JetStream on `127.0.0.1:4222`. The **target** is three clustered nodes so losing one server does not lose the stream. Fleet SSH hosts (`ns1`, later `lan-134`) run **workers**, not extra public NATS listeners.
+Today’s NS1 box (`NS1.GEORGELAMBERT.ORG`, `70.88.205.138`) still runs the **lab** JetStream on `127.0.0.1:4222` (keep/fleet/middleware). The **test cluster** is three distinct Proxmox LXC guests on `vmbr1` ([verae-nats-cluster](https://git.georgelambert.org/marchon/verae-nats-cluster)):
+
+```text
+nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222
+```
+
+(`nats-a` VMID 511, `nats-b` 512, `nats-c` 513). Cluster routes on `:6222`. Nothing on `vmbr0`. Cut over workers with `NATS_URL` listing all three; then the same configs move to separate hardware. Fleet SSH hosts run **workers**, not extra public NATS listeners.
 
 ![NATS cluster](diagrams/nats-cluster.svg)
 

packages/overview/10-docs-sync.md

@@ -22,6 +22,7 @@ Validated against the module list in `packages/` and Forgejo repos.
 - `verae-keep`
 - `verae-bootstrap` (clone + npm per server type; `scripts/host-deps.sh` installs OS/Node/NATS)
 - `verae-uptime`, `verae-backup`, `verae-deploy`, `verae-proxmox` (LXC 510 on NS1 `vmbr1`)
+- `verae-nats-cluster` (LXC 511–513 JetStream on `vmbr1`)
 
 ## Move the catalog to another hostname
 

packages/overview/11-hostnames.md

@@ -10,6 +10,9 @@ All of the running Verae Time × Zapier processes on **2026-09-11** live on one
 | `ns1` (SSH worker profile) | **NS1.GEORGELAMBERT.ORG** | `70.88.205.138` | Same box; SSH spawn unused while all-in-one is local |
 | `lan-134` | *(none yet)* | `70.88.205.134` | Disabled until SSH works |
 | `px-worker` | **verae-px-worker** (LXC **510**) | `10.10.10.20` on `vmbr1` | Extra worm/tree; enable after `verae-proxmox` create-worker |
+| *(nats-cluster)* | **nats-a** (LXC **511**) | `10.10.10.21` | JetStream node A (`:4222` / `:6222`) |
+| *(nats-cluster)* | **nats-b** (LXC **512**) | `10.10.10.22` | JetStream node B |
+| *(nats-cluster)* | **nats-c** (LXC **513**) | `10.10.10.23` | JetStream node C |
 
 Loopback on that box is `127.0.0.1`. Do **not** publish NATS `:4222`.