Clean prepaid SoT, identity mailbox, public access planes, leaf policy, fleet spawn

Persist account-balance books; edge caches prepaid from books. Add zappier-identity, verae-nats-accounts, verae-jobs-events, verae-access-staff, zapier-decisions. Edge binds loopback; lan-134 stays off; HTTP services prefer local spawn.

packages/overview/01-system.md

@@ -15,15 +15,15 @@ Verae Time proves a SHA-256 existed at a given time. Zapier lets customers regis
 | Direct customer API | `verae-access-api` `x-api-key` | HTTPS `:3022` |
 | S2S leaf | `verae-access-leaf` | NATS `verae.access.leaf.in` / HTTPS `:3023` |
 | Authz | `verae-access-authz` | `verae.access.authz.check` before any internal subject |
-| Commercial edge | `zappier-edge` portal, admin, Stripe (legacy combined) | Public HTTPS; NATS billing after authz |
+| Commercial edge | `zappier-edge` portal, admin, Stripe | Loopback `:3000`; public doors are access-* |
 | Account balance | `zappier-account-balance` prepaid SoT | NATS `verae.billing.*` + HTTP `:3010` |
 | CS / sales / accounting | `zappier-customer-service`, `zappier-sales-pricing`, `zappier-accounting-export` | Private HTTP; NATS statement/adjust |
-| Middleware HTTP | `/zapier/v1/*` job id + wait | Public HTTPS from edge only |
+| Middleware HTTP | `/zapier/v1/*` job id + wait | HTTPS from access-zapier / loopback edge |
 | NATS cluster | JetStream subjects under `verae.*` | Private; loopback or SSH tunnel |
 | Workers | poller, webhook-deliver, aggregator | NATS + HTTPS to chain or Zapier hooks |
 | Archives | WORM + tree nodes | NATS broadcast query; bloom miss = silence |
 | Chain | Verae timestamping | HTTPS `api.veraetime.net` or MOCK |
-| Control | `verae-fleet` | Operator loopback `:3850`; SSH to extra machines |
+| Control | `verae-fleet` | Operator HTTP `:3850` on `0.0.0.0`; SSH to extra machines |
 
 ## Request in one sentence