Turn lab IAM on, move portal to access-web, harden sessions and receipts.

Fleet and department doors now check STAFF_IAM_URL. Walkthrough: cs can
credit (agent is the IAM user) and cannot export; operator can fleet
POST; admin /me is owner. Portal is the public web door at :3021/portal/.
IAM sessions persist; login is rate-limited per user; receipt PDF is
branded. lan-134 stays disabled.

packages/verae-staff-iam/test/roles.test.js

@@ -12,6 +12,15 @@ test('owner expands to all permissions', () => {
   assert.ok(ROLES.sales);
 });
 
+test('sessions persist in dump/load', () => {
+  const iam = new StaffIam().seed();
+  const u = iam.findByUsername('cs');
+  const tok = iam.issueSession(u.id);
+  const raw = iam.dump();
+  const b = new StaffIam().load(raw);
+  assert.equal(b.getSession(tok).userId, u.id);
+});
+
 test('cannot deactivate last owner; passwords hash', () => {
   const iam = new StaffIam().seed();
   const owner = iam.findByUsername('admin');