Clean prepaid SoT, identity mailbox, public access planes, leaf policy, fleet spawn

Persist account-balance books; edge caches prepaid from books. Add zappier-identity, verae-nats-accounts, verae-jobs-events, verae-access-staff, zapier-decisions. Edge binds loopback; lan-134 stays off; HTTP services prefer local spawn.

packages/verae-nats-accounts/src/policy.js

@@ -0,0 +1,14 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const FILE = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'policy.json');
+
+export function loadPolicy() {
+  return JSON.parse(fs.readFileSync(FILE, 'utf8'));
+}
+
+export function leafAllowed(subject) {
+  const allow = loadPolicy().leafAllow || [];
+  return allow.some((p) => (p.endsWith('.') ? subject.startsWith(p) : subject === p || subject.startsWith(`${p}.`)));
+}