Close remaining IAM JSON doors and re-walk the lab.

CS/sales/accounting/staff list endpoints and sales pricing writes
require IAM; fleet service env sets STAFF_AUTH=1. Department tests
use a private books file so lab NATS does not leak into them.

packages/zappier-customer-service/src/server.js

@@ -87,6 +87,7 @@ const server = http.createServer(async (req, res) => {
       return json(r.status, body);
     }
     if (req.method === 'GET' && url.pathname === '/credits') {
+      if (!(await denyOrRedirect(req, res, json, { permission: 'cs.review' }))) return;
       const id = url.searchParams.get('customerId');
       if (!id) return json(400, { error: 'customerId required' });
       const out = await statement(id);