Clean prepaid SoT, identity mailbox, public access planes, leaf policy, fleet spawn

Persist account-balance books; edge caches prepaid from books. Add zappier-identity, verae-nats-accounts, verae-jobs-events, verae-access-staff, zapier-decisions. Edge binds loopback; lan-134 stays off; HTTP services prefer local spawn.

packages/zappier-account-balance/src/persist.js

@@ -0,0 +1,28 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+export function booksPath() {
+  return (
+    process.env.BOOKS_PATH ||
+    path.join(process.env.FLEET_STATE_DIR || process.cwd(), 'data', 'books.json')
+  );
+}
+
+export function loadInto(books) {
+  const p = booksPath();
+  if (!fs.existsSync(p)) return books;
+  try {
+    books.load(JSON.parse(fs.readFileSync(p, 'utf8')));
+  } catch {
+    /* keep empty */
+  }
+  return books;
+}
+
+export function saveFrom(books) {
+  const p = booksPath();
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  const tmp = `${p}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(books.dump(), null, 2));
+  fs.renameSync(tmp, p);
+}