Clean prepaid SoT, identity mailbox, public access planes, leaf policy, fleet spawn

Persist account-balance books; edge caches prepaid from books. Add zappier-identity, verae-nats-accounts, verae-jobs-events, verae-access-staff, zapier-decisions. Edge binds loopback; lan-134 stays off; HTTP services prefer local spawn.

docs/modules/verae-access-leaf/allow.md

@@ -0,0 +1,41 @@
+# `verae-access-leaf/allow`
+
+**Package:** `verae-access-leaf`  
+**Source:** `packages/verae-access-leaf/src/allow.js`  
+**Lines:** 29
+
+## What this module is
+
+Implementation module in `verae-access-leaf`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`leafAllowList`, `leafAllowed`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `leafAllowList` | `(none)` | — | `unknown` | see Call graph |
+| `leafAllowed` | `subject` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:fs`
+
+## Call graph (identifiers invoked)
+
+`leafAllowList`, `existsSync`, `parse`, `readFileSync`, `leafAllowed`, `some`, `endsWith`, `startsWith`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+

docs/modules/verae-access-leaf/server.md

@@ -2,7 +2,7 @@
 
 **Package:** `verae-access-leaf`  
 **Source:** `packages/verae-access-leaf/src/server.js`  
-**Lines:** 95
+**Lines:** 99
 
 ## What this module is
 
@@ -29,10 +29,11 @@ _None extracted._
 ## What it imports / requires
 
 - `node:http`
+- `./allow.js`
 
 ## Call graph (identifiers invoked)
 
-`subjects`, `replace`, `check`, `fetch`, `stringify`, `json`, `authorizedToken`, `forward`, `import`, `connect`, `split`, `publish`, `encode`, `flush`, `close`, `startNats`, `async`, `subscribe`, `parse`, `decode`, `respond`, `write`, `createServer`, `writeHead`, `end`, `push`, `concat`, `toString`, `listen`
+`subjects`, `replace`, `check`, `fetch`, `stringify`, `json`, `authorizedToken`, `forward`, `leafAllowed`, `import`, `connect`, `split`, `publish`, `encode`, `flush`, `close`, `startNats`, `async`, `subscribe`, `parse`, `decode`, `respond`, `write`, `createServer`, `writeHead`, `end`, `push`, `concat`, `toString`, `listen`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.