Add internal staff IAM: named users, roles, and management permissions.

verae-staff-iam (:3028) is the people directory — owner, billing-admin,
cs, sales, accounting, operator, viewer — with scrypt passwords, sessions,
and an audit log. Admin console login uses it when STAFF_IAM_URL is set
and hides tabs the account cannot use. CS/sales/accounting/staff/fleet
check permissions such as cs.credit and fleet.operate. Shared staff key
remains only as a fallback when IAM is unset.

packages/verae-fleet/services/staff-iam.json

@@ -0,0 +1,20 @@
+{
+  "id": "staff-iam",
+  "title": "Internal staff IAM (users, roles, permissions)",
+  "kind": "http",
+  "package": "verae-staff-iam",
+  "role": "staff-iam",
+  "managed": true,
+  "runtime": "HTTP :3028",
+  "health": { "type": "http", "path": "/health", "timeoutMs": 2000 },
+  "ports": { "healthBase": 3028 },
+  "spawn": {
+    "cwd": "../verae-staff-iam",
+    "command": "node",
+    "args": ["src/server.js"]
+  },
+  "env": {
+    "PORT": "3028"
+  },
+  "nats": { "in": [], "out": [] }
+}