Add internal staff IAM: named users, roles, and management permissions.

verae-staff-iam (:3028) is the people directory — owner, billing-admin,
cs, sales, accounting, operator, viewer — with scrypt passwords, sessions,
and an audit log. Admin console login uses it when STAFF_IAM_URL is set
and hides tabs the account cannot use. CS/sales/accounting/staff/fleet
check permissions such as cs.credit and fleet.operate. Shared staff key
remains only as a fallback when IAM is unset.

packages/verae-fleet/services/zappier-edge.json

@@ -15,6 +15,7 @@
   },
   "env": {
     "PORT": "3000",
+    "STAFF_IAM_URL": "http://127.0.0.1:3028",
     "BIND": "127.0.0.1",
     "ZAPPIER_UPSTREAM": "http://127.0.0.1:3100",
     "CS_SERVICE_URL": "http://127.0.0.1:3011",