Close remaining IAM JSON doors and re-walk the lab.

CS/sales/accounting/staff list endpoints and sales pricing writes
require IAM; fleet service env sets STAFF_AUTH=1. Department tests
use a private books file so lab NATS does not leak into them.

packages/zappier-customer-service/src/server.js

@@ -87,6 +87,7 @@ const server = http.createServer(async (req, res) => {
       return json(r.status, body);
     }
     if (req.method === 'GET' && url.pathname === '/credits') {
+      if (!(await denyOrRedirect(req, res, json, { permission: 'cs.review' }))) return;
       const id = url.searchParams.get('customerId');
       if (!id) return json(400, { error: 'customerId required' });
       const out = await statement(id);

packages/zappier-customer-service/test/health.test.js

@@ -2,6 +2,8 @@ import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 
 const root = path.dirname(fileURLToPath(new URL('.', import.meta.url)));
@@ -29,9 +31,10 @@ test('customer-service health', async () => {
 test('customer-service review via account-balance HTTP', async () => {
   const booksPort = 18014;
   const csPort = 18015;
+  const booksFile = path.join(os.tmpdir(), `cs-books-${process.pid}.json`);
   const books = spawn(process.execPath, ['src/server.js'], {
     cwd: path.join(root, '..', 'zappier-account-balance'),
-    env: { ...process.env, PORT: String(booksPort) },
+    env: { ...process.env, PORT: String(booksPort), BOOKS_PATH: booksFile, NATS_URL: '' },
     stdio: ['ignore', 'pipe', 'pipe'],
   });
   const cs = spawn(process.execPath, ['src/server.js'], {
@@ -40,6 +43,8 @@ test('customer-service review via account-balance HTTP', async () => {
       ...process.env,
       PORT: String(csPort),
       ACCOUNT_BALANCE_URL: `http://127.0.0.1:${booksPort}`,
+      NATS_URL: '',
+      STAFF_IAM_URL: '',
     },
     stdio: ['ignore', 'pipe', 'pipe'],
   });
@@ -58,5 +63,6 @@ test('customer-service review via account-balance HTTP', async () => {
   } finally {
     cs.kill('SIGTERM');
     books.kill('SIGTERM');
+    fs.rmSync(booksFile, { force: true });
   }
 });