NATS — verae-access-authz

Direction	Address	Kind
IN	`verae.access.authz.check`	request-reply, queue `access-authz`
OUT	`verae.access.authz.deny`	pub on deny (audit)

Body in: { plane, subject, principal, kind, payload }.
Body out: { allow, plane, subject, reason }.

Fail closed: if this process is down, access gateways must not forward.