Server-to-server leaf node access plane. Remote
machines connect as NATS leaf nodes (or POST /forward with
a leaf token). They never get the core billing subjects.
Forgejo: https://git.georgelambert.org/marchon/verae-access-leaf
remote leaf → verae.access.leaf.in → authz.check → verae.archive.put | jobs.*Denied: verae.billing.balance.adjust,
verae.billing.statement.get. A compromised WORM/leaf cannot
credit customers.
LEAF_TOKEN required. Port :3023. Do not
publish NATS 4222 to the internet; leaf nodes use a private
leafnode port / tunnel.