Close the last three UI leftovers: shared staff HTML, cookie domain, stock Swagger label.

verae-staff-ui holds one review template for CS and access-staff.
Staff cookies take STAFF_COOKIE_DOMAIN for a reverse-proxy host.
/docs stays vendor Swagger with an integrator banner only.

packages/zappier/src/app.ts

@@ -120,7 +120,16 @@ export function buildApp(deps: AppDeps = {}): {
   app.use(express.json());
 
   const spec = YAML.load(SPEC_PATH);
-  app.use('/docs', swaggerUi.serve, swaggerUi.setup(spec));
+  app.use(
+    '/docs',
+    swaggerUi.serve,
+    swaggerUi.setup(spec, {
+      customSiteTitle: 'OpenAPI explorer (stock Swagger UI)',
+      customCss:
+        'body::before{content:"OpenAPI explorer — stock Swagger UI for integrators. Not a customer surface. Use x-api-key.";' +
+        'display:block;background:#312e81;color:#eef0fe;font:650 13px -apple-system,sans-serif;padding:.7rem 1.2rem}',
+    }),
+  );
 
   app.use(
     '/admin/api',