Turn lab IAM on, move portal to access-web, harden sessions and receipts.

Fleet and department doors now check STAFF_IAM_URL. Walkthrough: cs can
credit (agent is the IAM user) and cannot export; operator can fleet
POST; admin /me is owner. Portal is the public web door at :3021/portal/.
IAM sessions persist; login is rate-limited per user; receipt PDF is
branded. lan-134 stays disabled.

packages/zappier/src/admin.ts

@@ -70,6 +70,33 @@ export function adminAuth(): RequestHandler {
       req.staff = sess;
       return next();
     }
+    const base = iamUrl();
+    if (base && token) {
+      void (async () => {
+        try {
+          const r = await fetch(`${base}/check`, { headers: { authorization: `Bearer ${token}` } });
+          if (!r.ok) {
+            res.status(403).json({ error: 'invalid or missing admin key' });
+            return;
+          }
+          const body = (await r.json()) as { user?: StaffSession };
+          if (body.user) {
+            req.staff = {
+              username: body.user.username,
+              name: body.user.name,
+              roles: body.user.roles,
+              permissions: body.user.permissions || [],
+              t: Date.now(),
+            };
+            return next();
+          }
+        } catch {
+          /* fall through */
+        }
+        res.status(403).json({ error: 'invalid or missing admin key' });
+      })();
+      return;
+    }
     res.status(403).json({ error: 'invalid or missing admin key' });
   };
 }