Clean prepaid SoT, identity mailbox, public access planes, leaf policy, fleet spawn

Persist account-balance books; edge caches prepaid from books. Add zappier-identity, verae-nats-accounts, verae-jobs-events, verae-access-staff, zapier-decisions. Edge binds loopback; lan-134 stays off; HTTP services prefer local spawn.

packages/verae-access-staff/test/health.test.js

@@ -0,0 +1,56 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const authzRoot = path.join(root, '..', 'verae-access-authz');
+const booksRoot = path.join(root, '..', 'zappier-account-balance');
+
+test('staff plane can credit after authz; zapier cannot', async () => {
+  const authzPort = 18031;
+  const booksPort = 18032;
+  const staffPort = 18033;
+  const authz = spawn(process.execPath, ['src/server.js'], {
+    cwd: authzRoot,
+    env: { ...process.env, PORT: String(authzPort) },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  const books = spawn(process.execPath, ['src/server.js'], {
+    cwd: booksRoot,
+    env: { ...process.env, PORT: String(booksPort), BOOKS_PATH: `/tmp/staff-books-${Date.now()}.json` },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  const staff = spawn(process.execPath, ['src/server.js'], {
+    cwd: root,
+    env: {
+      ...process.env,
+      PORT: String(staffPort),
+      AUTHZ_URL: `http://127.0.0.1:${authzPort}`,
+      ACCOUNT_BALANCE_URL: `http://127.0.0.1:${booksPort}`,
+    },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  await new Promise((r) => setTimeout(r, 600));
+  try {
+    const h = await (await fetch(`http://127.0.0.1:${staffPort}/health`)).json();
+    assert.equal(h.plane, 'staff');
+    const add = await fetch(`http://127.0.0.1:${staffPort}/credits`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ customerId: 'c-staff', cents: 50, reason: 'test', agent: 'cs' }),
+    });
+    assert.equal(add.status, 200);
+    const deny = await fetch(`http://127.0.0.1:${authzPort}/check`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ plane: 'zapier', subject: 'verae.billing.balance.adjust' }),
+    });
+    assert.equal(deny.status, 403);
+  } finally {
+    staff.kill('SIGTERM');
+    books.kill('SIGTERM');
+    authz.kill('SIGTERM');
+  }
+});