Clean prepaid SoT, identity mailbox, public access planes, leaf policy, fleet spawn

Persist account-balance books; edge caches prepaid from books. Add zappier-identity, verae-nats-accounts, verae-jobs-events, verae-access-staff, zapier-decisions. Edge binds loopback; lan-134 stays off; HTTP services prefer local spawn.

docs/modules/zappier-account-balance/server.md

@@ -2,7 +2,7 @@
 
 **Package:** `zappier-account-balance`  
 **Source:** `packages/zappier-account-balance/src/server.js`  
-**Lines:** 93
+**Lines:** 101
 
 ## What this module is
 
@@ -20,6 +20,7 @@ _None extracted._
 
 | Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
 |------|------------|---------------------|---------|-----------------------------|
+| `apply` | `subject, payload` | — | `unknown` | see Call graph |
 | `startNats` | `(none)` | — | `unknown` | see Call graph |
 | `readBody` | `req` | — | `unknown` | see Call graph |
 | `reply` | `sub, fn` | — | `unknown` | see Call graph |
@@ -29,6 +30,7 @@ _None extracted._
 
 | Name | Parameters |
 |------|------------|
+| `saveFrom` | `books` |
 | `reply` | `nc.subscribe(SUBJECTS.STATEMENT_GET, { queue: SUBJECTS.QUEUE }` |
 | `reply` | `nc.subscribe(SUBJECTS.BALANCE_GET, { queue: SUBJECTS.QUEUE }` |
 | `reply` | `nc.subscribe(SUBJECTS.BALANCE_ADJUST, { queue: SUBJECTS.QUEUE }` |
@@ -38,10 +40,11 @@ _None extracted._
 - `node:http`
 - `./books.js`
 - `./subjects.js`
+- `./persist.js`
 
 ## Call graph (identifiers invoked)
 
-`startNats`, `import`, `connect`, `split`, `async`, `parse`, `decode`, `fn`, `respond`, `encode`, `stringify`, `reply`, `subscribe`, `handle`, `write`, `readBody`, `on`, `push`, `resolve`, `concat`, `toString`, `createServer`, `writeHead`, `end`, `json`, `match`, `statement`, `adjust`, `listen`
+`loadInto`, `apply`, `handle`, `saveFrom`, `startNats`, `import`, `connect`, `split`, `async`, `parse`, `decode`, `fn`, `respond`, `encode`, `stringify`, `reply`, `subscribe`, `write`, `readBody`, `on`, `push`, `resolve`, `concat`, `toString`, `createServer`, `writeHead`, `end`, `json`, `match`, `statement`, `listen`
 
 Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.