feat: site WIP — downloads, explorer, hasher, TestFlight enroll

Commit restored mcp.verae.ai site pages (app, register, macos, windows,
explorer), hasher/download artifacts, index/sample/hasher updates, ledger
and global_client improvements, NATS stamp helper, and TestFlight enroll
service. Ignore debug-trace/ and editor backups. Standard Readme for
download and enroll docs.

tests/test_global_client.py

@@ -35,9 +35,33 @@ class FakeHttp:
                     "blockHash": "0xdead",
                 },
             )
+        if "/api/hash/" in url:
+            digest = url.rsplit("/", 1)[-1]
+            return _Resp(
+                200,
+                {
+                    "digest": digest,
+                    "receipts": [
+                        {
+                            "jobId": "job-1",
+                            "certificate": "job-1",
+                            "digest": digest,
+                            "completedAt": "2026-08-15T00:00:00Z",
+                        }
+                    ],
+                },
+            )
         if url.endswith("/api/verify"):
             if payload.get("certificate") == "job-1":
-                return _Resp(200, {"valid": True, "hash": SHA256_EMPTY})
+                return _Resp(
+                    200,
+                    {
+                        "valid": True,
+                        "hash": SHA256_EMPTY,
+                        "timestamp": "2026-08-15T00:00:00Z",
+                        "blockIndex": 113072,
+                    },
+                )
             return _Resp(200, {"valid": False})
         if "/api/status/" in url:
             return _Resp(
@@ -178,7 +202,11 @@ async def test_routing_sends_only_global_scope_to_central():
     assert http.calls[0][1].endswith("/api/timestamp")
 
     cached = await routed.hash_report(SHA256_EMPTY, want_scope="global")
-    assert cached == []
+    assert len(cached) == 1
+    assert cached[0].receipt_id == "job-1"
+    assert cached[0].scope == "global"
+    assert cached[0].merkle == "113072"
+    assert any("/api/hash/" in c[1] for c in http.calls)
 
     weak = await routed.verify(local_rec.receipt_id, want_scope="global")
     assert weak.valid is False
@@ -338,3 +366,17 @@ async def test_submit_skips_login_when_token_is_fresh(tmp_path):
     assert rec.receipt_id == "QmFresh"
     assert http.calls[0][1].endswith("/api/timestamp")
     assert http.calls[0][3]["Authorization"] == "Bearer still-good"
+
+
+async def test_global_hash_report_uses_api_hash():
+    http = FakeHttp()
+    ledger = GlobalLedger(GlobalClient("https://api.veraetime.net", token="secret", http=http))
+    recs = await ledger.hash_report(SHA256_EMPTY, want_scope="global")
+    assert len(recs) == 1
+    assert recs[0].receipt_id == "job-1"
+    assert recs[0].hash == SHA256_EMPTY
+    assert recs[0].merkle == "113072"
+    methods_urls = [(m, u) for m, u, _, _ in http.calls]
+    assert methods_urls[0] == ("GET", f"https://api.veraetime.net/api/hash/{SHA256_EMPTY}")
+    assert methods_urls[1][0] == "POST"
+    assert methods_urls[1][1].endswith("/api/verify")