Add live HTTPS door cards and screenshots to the catalog.

Homepage bottom of zapier.georgelambert.org lists each public
service with a description, screenshot, and link. UI-REVIEW.pdf
and the walkthrough document those doors.

packages/ui-docs/scripts/build-review-pdf.py

@@ -76,6 +76,34 @@ PAGES = [
      "Left as vendor Swagger. Do not treat it as the customer portal."),
     ("22-catalog.png", "PDF catalog",
      "https://zapier.georgelambert.org/ uses system-ui on the indigo header, not Georgia."),
+    ("live/portal.png", "Live — customer portal",
+     "https://portal.zapier.georgelambert.org/portal/ — public signup and sign-in. Let's Encrypt. Access-web on NS1."),
+    ("live/api.png", "Live — customer API",
+     "https://api.zapier.georgelambert.org/health — direct customer API plane (x-api-key)."),
+    ("live/leaf.png", "Live — S2S leaf",
+     "https://leaf.zapier.georgelambert.org/health — server-to-server leaf. No billing subjects."),
+    ("live/zap.png", "Live — Zapier plane",
+     "https://zap.zapier.georgelambert.org/health — Zapier Platform HTTPS only. Cloud never talks to NATS."),
+    ("live/staff.png", "Live — staff plane",
+     "https://staff.zapier.georgelambert.org/ — IAM login, then CS/sales/accounting door."),
+    ("live/iam.png", "Live — staff IAM",
+     "https://iam.zapier.georgelambert.org/ — named users, roles, sessions. Seed admin / admin-dev-key."),
+    ("live/login.png", "Live — staff session",
+     "https://login.zapier.georgelambert.org/ — shared staff cookie; proxies IAM."),
+    ("live/cs.png", "Live — customer service",
+     "https://cs.zapier.georgelambert.org/ — review prepaid and credit in USD after IAM."),
+    ("live/sales.png", "Live — sales",
+     "https://sales.zapier.georgelambert.org/ — per-customer quote after IAM."),
+    ("live/acct.png", "Live — accounting",
+     "https://acct.zapier.georgelambert.org/ — QuickBooks IIF / CSV after IAM."),
+    ("live/mw.png", "Live — middleware",
+     "https://mw.zapier.georgelambert.org/health — /zapier/v1, jobs, archive, MOCK_VERAE in lab."),
+    ("live/fleet.png", "Live — operator console",
+     "https://fleet.zapier.georgelambert.org/ — Fleet / Trace / Docs. Pause/stop honored by keep."),
+    ("live/docs.png", "Live — documentation catalog",
+     "https://zapier.georgelambert.org/ — colored PDF catalog. Live service cards at the bottom."),
+    ("live/git.png", "Live — Forgejo",
+     "https://git.georgelambert.org/ — independent module repos, SSH port 2223."),
 ]
 
 
@@ -126,12 +154,13 @@ def main():
         "Catalog body font is system-ui. Swagger /docs stays stock with an integrator banner only.",
         "CS and access-staff share verae-staff-ui review.html.",
         "Staff cookies accept STAFF_COOKIE_DOMAIN for a reverse-proxy host.",
+        "Public HTTPS doors on *.zapier.georgelambert.org (Caddy + Let's Encrypt). Catalog homepage lists each with a screenshot.",
     ]
     for it in items:
         story.append(p("• " + it, s["body"]))
 
     story.append(p("How to use each surface", s["h1"]))
-    story.append(p("Operator: open :3850, Fleet for replicas, Trace to inject a Zap step, Docs for PDFs. Staff: CS :3011 credit in USD; Sales :3012 quote; Accounting :3013 export; Staff plane :3025 after authz. Customers: /portal. Ops: /admin. Lab: simulator :3847.", s["body"]))
+    story.append(p("Public HTTPS on NS1 (Let's Encrypt): portal.zapier.georgelambert.org/portal/ for customers; zap.zapier.georgelambert.org for Zapier; api.zapier.georgelambert.org for API keys; fleet / cs / sales / acct / staff / iam for operators after IAM login. Loopback still used for NATS, keep, archive workers, and zappier-edge :13000.", s["body"]))
 
     story.append(p("Issues still to consider", s["h1"]))
     story.append(p("None. The designer-review backlog is empty.", s["body"]))