Milestone 0: import zappier billing, Verae middleware, and Zapier research

Compose-ready workspace: packages/zappier (rate card, portal, Stripe),
packages/verae-zapier-middleware (timestamp + NATS), packages/verae-zapier
(CLI app), vendor/zapier-platform, and research/zapier vendor corpus.

Gate 0 structure checks pass. Product code and research are not yet wired.

packages/verae-zapier-middleware/src/app.js

@@ -0,0 +1,50 @@
+/**
+ * @fileoverview Express application factory for the Zapier-facing HTTP edge.
+ * @module app
+ */
+
+import express from 'express';
+import { sendError } from './errors.js';
+import { createDebugger } from './debug/logger.js';
+import { traceMiddleware } from './debug/trace.js';
+import { apiRoutes } from './routes/index.js';
+import { loadStore } from './store/db.js';
+
+const log = createDebugger('app');
+
+/**
+ * Create the Express app (does not listen).
+ *
+ * @param {{ load?: boolean }} [options]
+ * @returns {import('express').Express}
+ */
+export function createApp(options = {}) {
+  if (options.load !== false) {
+    loadStore();
+  }
+
+  const app = express();
+  app.disable('x-powered-by');
+
+  app.use(express.json({ limit: '1mb' }));
+  app.use(traceMiddleware);
+
+  /**
+   * Liveness probe.
+   */
+  app.get('/health', (_req, res) => {
+    res.json({
+      status: 'ok',
+      service: 'verae-zapier-middleware',
+    });
+  });
+
+  app.use('/zapier', apiRoutes);
+
+  app.use((err, _req, res, _next) => {
+    sendError(res, err);
+  });
+
+  log.info('express app created');
+  return app;
+}