Put zapier.georgelambert.org service names on Caddy.

HTTPS reverse-proxy for portal, api, leaf, zap, staff, iam, login,
cs, sales, acct, mw, and fleet. Staff HTML login redirects use
X-Forwarded-Proto so next= is https on the public host.

packages/verae-ops/05-dedicated-hardware.md

@@ -8,7 +8,7 @@ NS1-style: a box that already runs NATS on **127.0.0.1:4222** (never a public bi
 2. `nats-server -js` listening **127.0.0.1:4222** only (cluster later on a private NIC).
 3. Clone `zappier-edge`, `verae-middleware`, `verae-fleet`.
 4. systemd units (below) or `verae-fleet serve` which keepFloor-spawns workers.
-5. Caddy/nginx for public HTTPS to **access-web `:3021/portal/`** and **access-zapier `:3024`**. zappier-edge stays loopback (`:3000`, or `:13000` on NS1 if `:3000` is already taken).
+5. Caddy file `caddy/zapier-services.georgelambert.org.caddy` on NS1: `portal`/`zap`/`api`/staff/fleet hostnames → local ports. zappier-edge stays loopback (`:3000`, or `:13000` on NS1 if `:3000` is already taken).
 6. Operator console: `0.0.0.0:3850`. `verae-keep` (`:3860`) + `watch` (`:3861`) + `guard.sh` keep workers up unless you paused/stopped them in the console.
 7. Clone/install: [verae-bootstrap](https://git.georgelambert.org/marchon/verae-bootstrap) type `ns1-all-in-one`.