Open todos

Live api.veraetime.net with MOCK_VERAE=false and admin bind credentials.
NATS nkeys/mTLS on a real three-node cluster (accounts file is the lab stand-in).
Exclusive JetStream consumer for verae.zapier.jobs.events on verae-jobs-events (middleware still also listens).
Auth on CS/sales/accounting HTML (staff plane is the intended door).
Zapier Platform push of a private app.
Move portal static files fully into verae-access-web (today it proxies /portal to loopback edge).