Close remaining IAM JSON doors and re-walk the lab.

CS/sales/accounting/staff list endpoints and sales pricing writes
require IAM; fleet service env sets STAFF_AUTH=1. Department tests
use a private books file so lab NATS does not leak into them.

packages/verae-fleet/services/access-staff.json

@@ -17,7 +17,8 @@
     "PORT": "3025",
     "AUTHZ_URL": "http://127.0.0.1:3020",
     "ACCOUNT_BALANCE_URL": "http://127.0.0.1:3010",
-    "STAFF_IAM_URL": "http://127.0.0.1:3028"
+    "STAFF_IAM_URL": "http://127.0.0.1:3028",
+    "STAFF_AUTH": "1"
   },
   "nats": { "in": [], "out": ["verae.access.authz.check"] }
 }