Clean prepaid SoT, identity mailbox, public access planes, leaf policy, fleet spawn

Persist account-balance books; edge caches prepaid from books. Add zappier-identity, verae-nats-accounts, verae-jobs-events, verae-access-staff, zapier-decisions. Edge binds loopback; lan-134 stays off; HTTP services prefer local spawn.

packages/verae-nats-accounts/policy.json

@@ -0,0 +1,35 @@
+{
+  "accounts": {
+    "INTERNAL": {
+      "publish": [">"],
+      "subscribe": [">"]
+    },
+    "LEAF": {
+      "publish": [
+        "verae.access.leaf.in",
+        "verae.archive.put",
+        "verae.archive.query",
+        "verae.archive.reply.*",
+        "verae.zapier.jobs.watch",
+        "verae.zapier.jobs.events",
+        "verae.zapier.webhooks.deliver"
+      ],
+      "subscribe": [
+        "verae.access.leaf.in",
+        "verae.archive.>",
+        "verae.zapier.jobs.>",
+        "verae.zapier.webhooks.deliver"
+      ],
+      "deny_publish": ["verae.billing.>", "verae.access.authz.>"],
+      "deny_subscribe": ["verae.billing.>"]
+    }
+  },
+  "leafAllow": [
+    "verae.archive.put",
+    "verae.archive.query",
+    "verae.archive.reply.",
+    "verae.zapier.jobs.watch",
+    "verae.zapier.jobs.events",
+    "verae.zapier.webhooks.deliver"
+  ]
+}