Close remaining IAM JSON doors and re-walk the lab.

CS/sales/accounting/staff list endpoints and sales pricing writes
require IAM; fleet service env sets STAFF_AUTH=1. Department tests
use a private books file so lab NATS does not leak into them.

packages/zappier-accounting-export/src/server.js

@@ -35,6 +35,7 @@ const server = http.createServer(async (req, res) => {
       return json(200, { ok: true, role: 'zappier-accounting-export' });
     }
     if (req.method === 'GET' && url.pathname === '/customers') {
+      if (!(await denyOrRedirect(req, res, json, { permission: 'accounting.review' }))) return;
       return json(200, { customers: await listCustomers(EDGE, KEY) });
     }
     const review = url.pathname.match(/^\/review\/([^/]+)$/);