Docs sync: portal, IAM, keep, bootstrap

Documentation sync (2026-09-11)

Validated against the module list in packages/ and Forgejo repos.

Current public doors

Door	Bind	Notes
Customer portal	access-web `:3021/portal/`	Static + `/portal/api` → loopback edge
Customer API	access-api `:3022`
S2S leaf	access-leaf `:3023`	No billing subjects
Zapier	access-zapier `:3024`	Only Zapier HTTPS
Staff plane	access-staff `:3025`	After IAM
zappier-edge	loopback `:3000` (NS1 all-in-one `:13000`)	Admin, Stripe, not a public portal
Operator console	fleet `:3850` on `0.0.0.0`	Pause/stop honored by keep
Staff IAM	`:3028`	Named users, roles, sessions
Keep	`:3860` + watch `:3861` + `guard.sh`	Restart unless paused/stopped

New modules since the last catalog pass

verae-staff-iam, verae-staff-session, verae-staff-ui
verae-keep
verae-bootstrap (clone + npm per server type; scripts/host-deps.sh installs OS/Node/NATS)
verae-uptime, verae-backup, verae-deploy, verae-proxmox (LXC 510 on NS1 vmbr1)
verae-nats-cluster (LXC 511–513 JetStream on vmbr1)

Move the catalog to another hostname

HTML and PDF catalog links are path-relative. Rsync site/ to a new document root (for example docs.verae-time.net) without rewriting files.

Procedure: CATALOG-HOST.md in zapier-docs-master
Optional absolute retarget: python3 scripts/rewrite-docs-host.py --site ./site --from https://zapier.georgelambert.org --to https://docs.verae-time.net
Host packages for a new box: bash packages/verae-bootstrap/scripts/host-deps.sh --type ns1-all-in-one

Still blocked (not closable here)

Live api.veraetime.net (MOCK_VERAE=false)
NATS nkeys/mTLS three-node cluster
Zapier Platform push