Add internal staff IAM: named users, roles, and management permissions.

verae-staff-iam (:3028) is the people directory — owner, billing-admin,
cs, sales, accounting, operator, viewer — with scrypt passwords, sessions,
and an audit log. Admin console login uses it when STAFF_IAM_URL is set
and hides tabs the account cannot use. CS/sales/accounting/staff/fleet
check permissions such as cs.credit and fleet.operate. Shared staff key
remains only as a fallback when IAM is unset.

packages/verae-fleet/services/customer-service.json

@@ -18,7 +18,8 @@
     "ZAPPIER_ADMIN_URL": "http://127.0.0.1:3000",
     "ACCOUNT_BALANCE_URL": "http://127.0.0.1:3010",
     "NATS_URL": "nats://127.0.0.1:4222",
-    "AUTHZ_URL": "http://127.0.0.1:3020"
+    "AUTHZ_URL": "http://127.0.0.1:3020",
+    "STAFF_IAM_URL": "http://127.0.0.1:3028"
   },
   "nats": {
     "in": [],