Clean prepaid SoT, identity mailbox, public access planes, leaf policy, fleet spawn

Persist account-balance books; edge caches prepaid from books. Add zappier-identity, verae-nats-accounts, verae-jobs-events, verae-access-staff, zapier-decisions. Edge binds loopback; lan-134 stays off; HTTP services prefer local spawn.

docs/modules/zappier/verae-bind.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier`  
 **Source:** `packages/zappier/src/verae-bind.ts`  
-**Lines:** 77
+**Lines:** 90
 
 ## What this module is
 
@@ -25,7 +25,7 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 | `normalizeVeraeUsername` | `username: string` | — | `unknown` | see Call graph |
 | `stableVeraeUserId` | `username: string` | — | `unknown` | see Call graph |
 | `mockBind` | `email: string` | — | `unknown` | see Call graph |
-| `bindVeraeUser` | `email: string` | — | `unknown` | see Call graph |
+| `bindVeraeUser` | `email: string, customerId?: string` | — | `unknown` | see Call graph |
 | `login` | `username: string, pass: string` | — | `unknown` | see Call graph |
 
 ## What it imports / requires
@@ -34,7 +34,7 @@ Implementation module in `zappier`. The tables below are extracted from the sour
 
 ## Call graph (identifiers invoked)
 
-`normalizeVeraeUsername`, `trim`, `toLowerCase`, `stableVeraeUserId`, `createHash`, `update`, `digest`, `slice`, `mockBind`, `bindVeraeUser`, `replace`, `randomBytes`, `toString`, `async`, `fetch`, `stringify`, `json`, `login`
+`normalizeVeraeUsername`, `trim`, `toLowerCase`, `stableVeraeUserId`, `createHash`, `update`, `digest`, `slice`, `mockBind`, `bindVeraeUser`, `replace`, `fetch`, `stringify`, `json`, `randomBytes`, `toString`, `async`, `login`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.