Add internal staff IAM: named users, roles, and management permissions.

verae-staff-iam (:3028) is the people directory — owner, billing-admin,
cs, sales, accounting, operator, viewer — with scrypt passwords, sessions,
and an audit log. Admin console login uses it when STAFF_IAM_URL is set
and hides tabs the account cannot use. CS/sales/accounting/staff/fleet
check permissions such as cs.credit and fleet.operate. Shared staff key
remains only as a fallback when IAM is unset.

packages/verae-fleet/services/accounting-export.json

@@ -17,7 +17,8 @@
     "PORT": "3013",
     "ZAPPIER_ADMIN_URL": "http://127.0.0.1:3000",
     "ACCOUNT_BALANCE_URL": "http://127.0.0.1:3010",
-    "NATS_URL": "nats://127.0.0.1:4222"
+    "NATS_URL": "nats://127.0.0.1:4222",
+    "STAFF_IAM_URL": "http://127.0.0.1:3028"
   },
   "nats": { "in": [], "out": ["verae.billing.statement.get"] }
 }