feat: serve /v1 over ZAP — zip v0.5.0, real dual transport

zip v0.5.0 un-stubs the ZAP transport, so cloud now serves BOTH transports from
the ONE app: app.Serve(cfg.ZAPListenAddr, cfg.ListenAddr) binds ZAP (primary,
:9653 via CLOUD_ZAP_LISTEN — already in config) alongside HTTP (:8000). The log
already advertised the zap addr; now it is actually bound. Every /v1 route answers
identically over either transport (no RPC registry, routes ARE the ZAP surface).

- go.mod: hanzoai/zip v0.2.1 -> v0.5.0 (+ zap-proto/http v0.1.0 transitively).
- serve.go: app.Listen(http) -> app.Serve(zap, http).

Verified: go build ./... green (whole 54-file zip surface); go vet clean;
cloud + zapface + storagelock + admin tests pass. Prod ZAP port :9653 will be
open (was closed — the stub never bound).

go.mod

@@ -14,7 +14,7 @@ require (
 	github.com/hanzoai/kms/sdk/go v1.1.1
 	github.com/hanzoai/plans v1.2.0
 	github.com/hanzoai/pricing v1.3.0
-	github.com/hanzoai/zip v0.2.1
+	github.com/hanzoai/zip v0.5.0
 	github.com/jackc/pgx/v5 v5.9.1
 	github.com/lib/pq v1.12.3
 	github.com/luxfi/log v1.4.3
@@ -30,7 +30,10 @@ require (
 	modernc.org/sqlite v1.51.0
 )
 
-require github.com/google/flatbuffers v25.12.19+incompatible // indirect
+require (
+	github.com/google/flatbuffers v25.12.19+incompatible // indirect
+	github.com/zap-proto/http v0.1.0 // indirect
+)
 
 require (
 	cel.dev/expr v0.25.1 // indirect

go.sum

@@ -1201,6 +1201,8 @@ github.com/hanzoai/xorm v1.1.6 h1:z8B3alP39taTGLA4BonBa+7RHIOMmjYjxF3N9gpzh84=
 github.com/hanzoai/xorm v1.1.6/go.mod h1:wso0cQDDuzgjJwNOj3AXCftkKF3uOoUowKp5A7ol0zc=
 github.com/hanzoai/zip v0.2.1 h1:lxVRVqE+yuF6BHmPVt03ip+xOAezSlYa07X5Z9FGfhs=
 github.com/hanzoai/zip v0.2.1/go.mod h1:bIH1x3KJjVq34/l1pBCchOqrWsQWHVlAOaSc2CSscag=
+github.com/hanzoai/zip v0.5.0 h1:sRo1W1LC6Jd/yupBZ5Z9c2Vjb6UsTz/AfxJ7LiSF0I4=
+github.com/hanzoai/zip v0.5.0/go.mod h1:a7hsqKVC5ygXjLKfb1WGibI81vNBSaxLbX4tM94GyhE=
 github.com/hashicorp/consul/api v1.10.1/go.mod h1:XjsvQN+RJGWI2TWy1/kqaE16HrR2J/FWgkYjdZQsX9M=
 github.com/hashicorp/consul/api v1.12.0/go.mod h1:6pVBMo0ebnYdt2S3H87XhekM/HHrUoTD2XXb/VrZVy0=
 github.com/hashicorp/consul/api v1.13.0/go.mod h1:ZlVrynguJKcYr54zGaDbaL3fOvKC9m72FhPvA8T35KQ=
@@ -2183,6 +2185,8 @@ github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 github.com/zap-proto/go v1.3.0 h1:S3rMoawwhH/BbSZ4G8zG05hJoQnMSMDPzIq75diCTqE=
 github.com/zap-proto/go v1.3.0/go.mod h1:914SNGTH6Rv3Yu1MweWJBPEN8FZlo5C39QyhaB0C7Q0=
+github.com/zap-proto/http v0.1.0 h1:aA8NmU/a0yM7QFU5tjXPYHFiBUcoHn92wjMy181o50M=
+github.com/zap-proto/http v0.1.0/go.mod h1:UYfGhDDCetgxs65XSev8Lpf65COg5vKQK+cWwZGh4zQ=
 github.com/zeebo/assert v1.3.1 h1:vukIABvugfNMZMQO1ABsyQDJDTVQbn+LWSMy1ol1h6A=
 github.com/zeebo/assert v1.3.1/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
 github.com/zeebo/blake3 v0.2.4 h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=

serve.go

@@ -163,7 +163,11 @@ func Serve(enable []string) error {
 			"brand", cfg.Brand,
 			"domain", cfg.Domain,
 		)
-		listenErr <- app.Listen(cfg.ListenAddr)
+		// ONE app, TWO transports: ZAP is the primary machine transport
+		// (TLS 1.3 + PQ), plain HTTP the edge/browser extra. Both serve the
+		// identical route surface, so /v1/* answers over either. Serve returns
+		// the first listener error.
+		listenErr <- app.Serve(cfg.ZAPListenAddr, cfg.ListenAddr)
 	}()
 
 	select {