Close remaining IAM JSON doors and re-walk the lab.

CS/sales/accounting/staff list endpoints and sales pricing writes
require IAM; fleet service env sets STAFF_AUTH=1. Department tests
use a private books file so lab NATS does not leak into them.

packages/zapier-decisions/LOG.md

@@ -32,6 +32,12 @@
 - Disable lan-134 unless `FLEET_ENABLE_LAN134=1`.
 - SSH spawn timeout 8s; failed hosts skipped.
 
+## 2026-09-11 — IAM JSON doors closed
+
+- CS/sales/accounting/staff JSON list and sales PUT pricing now go through IAM (401 JSON, 302 HTML).
+- Fleet service env sets `STAFF_AUTH=1` with `STAFF_IAM_URL`.
+- Re-walk: cs credit 200 agent=`cs`; cs export 403; operator Fleet POST 200; admin `/me` `permissions:['*']`.
+
 ## 2026-09-11 — IAM on lab, portal door, hardening
 
 - Restarted fleet with `STAFF_IAM_URL`. Walk: cs credits (agent=`cs`) and is 403 on accounting export; operator fleet POST 200, cs 403; admin `/me` permissions `*`.

packages/zapier-decisions/TODO.md

@@ -7,3 +7,5 @@
 - [x] Staff IAM: named users, roles, permissions (`verae-staff-iam` :3028).
 - [ ] Zapier Platform `push` of a private app.
 - [x] Move portal static files fully into `verae-access-web` (`/portal/` public door; API proxied to loopback edge).
+- [x] Turn IAM on for the running lab (fleet `STAFF_IAM_URL` + restart).
+- [x] IAM hardening: JSON sessions, login rate-limit, JSON 401 as well as HTML 302, credit principal = IAM username.