Add NATS account-balance SoT and statement review for customers, CS, and sales

Internal billing now uses verae.billing.* request-reply and pubs. zappier-account-balance tracks prepaid, credits, usage, and payments. Portal, admin, CS, and sales all review the same statement. Independent Forgejo repos stay split via push-module-repos.

docs/sphinx/modules/zappier/app.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/app.ts`  
-**Lines:** 257
+**Lines:** 272
 
 ## What this module is
 
@@ -24,6 +24,7 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 | Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
 |------|------------|---------------------|---------|-----------------------------|
 | `buildApp` | `deps: AppDeps = {}` | — | `unknown` | see Call graph |
+| `onUsage` | `e: { customerId: string; endpointId: string; cents: number }` | — | `unknown` | see Call graph |
 
 ## What it imports / requires
 
@@ -44,10 +45,14 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 - `./invoicing`
 - `./paths`
 - `./portal`
+- `./upstream`
+- `./credits`
+- `./statement`
+- `./billing-nats`
 
 ## Call graph (identifiers invoked)
 
-`join`, `next`, `parse`, `status`, `json`, `buildApp`, `seeded`, `seedAdminUsersFromEnv`, `rateCard`, `getRateCard`, `tiers`, `getTiers`, `express`, `use`, `load`, `setup`, `adminLoginRouter`, `adminAuth`, `adminRouter`, `static`, `async`, `import`, `toDataURL`, `portalRouter`, `apiKeyAuth`, `middleware`, `get`, `meter`, `post`, `toUpperCase`, `toLowerCase`, `createHash`, `update`, `digest`, `randomUUID`, `toISOString`, `set`, `isFinite`, `map`, `unshift`, `filter`, `setUTCDate`, `setUTCHours`, `summaryFor`, `find`, `applyMonthlyCredit`
+`join`, `next`, `parse`, `status`, `json`, `buildApp`, `seeded`, `seedAdminUsersFromEnv`, `rateCard`, `getRateCard`, `tiers`, `getTiers`, `natsPublish`, `toISOString`, `express`, `use`, `load`, `setup`, `adminLoginRouter`, `adminAuth`, `adminRouter`, `static`, `async`, `import`, `toDataURL`, `portalRouter`, `get`, `apiKeyAuth`, `middleware`, `meter`, `post`, `toUpperCase`, `proxyVerae`, `toLowerCase`, `createHash`, `update`, `digest`, `randomUUID`, `set`, `isFinite`, `map`, `unshift`, `filter`, `setUTCDate`, `setUTCHours`, `summaryFor`, `find`, `applyMonthlyCredit`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.