Add customer names on the ledger, staff session login, and exclusive jobs.events.

Account-balance stores display names and looks up by name. Edge writes
names on customer create/edit; staff UIs join from edge when needed.
New verae-staff-session issues a host cookie; department HTML redirects
when STAFF_AUTH=1. JOBS_EVENTS_EXCLUSIVE lets jobs-events own the durable
consumer. Catalog index is cards; disabled fleet machines are grey.

packages/verae-staff-session/test/token.test.js

@@ -0,0 +1,11 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { sessionToken, cookieOk, headerOk } from '../src/token.js';
+
+test('cookie matches HMAC of staff key', () => {
+  const tok = sessionToken();
+  assert.equal(tok.length, 64);
+  assert.equal(cookieOk({ headers: { cookie: `staff_session=${tok}` } }), true);
+  assert.equal(cookieOk({ headers: { cookie: 'staff_session=nope' } }), false);
+  assert.equal(headerOk({ headers: { 'x-staff-key': process.env.STAFF_KEY || 'admin-dev-key' } }), true);
+});