Clean prepaid SoT, identity mailbox, public access planes, leaf policy, fleet spawn

Persist account-balance books; edge caches prepaid from books. Add zappier-identity, verae-nats-accounts, verae-jobs-events, verae-access-staff, zapier-decisions. Edge binds loopback; lan-134 stays off; HTTP services prefer local spawn.

packages/verae-nats-accounts/nats.conf

@@ -0,0 +1,21 @@
+# Lab accounts sketch. Loopback only. Do not publish 4222.
+# INTERNAL: middleware, account-balance, authz, identity.
+# LEAF: access-leaf and remote leaf nodes — no billing.
+
+listen: 127.0.0.1:4222
+http: 127.0.0.1:8222
+jetstream {}
+
+accounts {
+  INTERNAL {
+    users = [ { user: internal, password: internal-dev } ]
+    jetstream: enabled
+  }
+  LEAF {
+    users = [ { user: leaf, password: leaf-dev } ]
+    exports = []
+    imports = []
+  }
+}
+# Subject restrictions for LEAF are enforced in policy.json + access-leaf
+# until this nats-server is started with full auth callout.