Add internal staff IAM: named users, roles, and management permissions.

verae-staff-iam (:3028) is the people directory — owner, billing-admin,
cs, sales, accounting, operator, viewer — with scrypt passwords, sessions,
and an audit log. Admin console login uses it when STAFF_IAM_URL is set
and hides tabs the account cannot use. CS/sales/accounting/staff/fleet
check permissions such as cs.credit and fleet.operate. Shared staff key
remains only as a fallback when IAM is unset.

packages/verae-staff-session/src/server.js

@@ -50,8 +50,35 @@ const server = http.createServer(async (req, res) => {
     res.writeHead(code, { 'content-type': 'application/json' });
     res.end(JSON.stringify(obj));
   };
+  const IAM = (process.env.STAFF_IAM_URL || '').replace(/\/$/, '');
+  if (IAM && req.method === 'GET' && (url.pathname === '/' || url.pathname === '/login')) {
+    const next = url.searchParams.get('next') || '';
+    res.writeHead(302, { location: `${IAM}/login?next=${encodeURIComponent(next)}` });
+    return res.end();
+  }
+  if (IAM && (url.pathname === '/check' || url.pathname === '/login' || url.pathname === '/logout')) {
+    const target = `${IAM}${url.pathname}${url.search}`;
+    const r = await fetch(target, {
+      method: req.method,
+      headers: { cookie: req.headers.cookie || '', authorization: req.headers.authorization || '', 'content-type': req.headers['content-type'] || '' },
+      body: req.method === 'GET' ? undefined : await new Promise((resolve) => {
+        const chunks = [];
+        req.on('data', (c) => chunks.push(c));
+        req.on('end', () => resolve(Buffer.concat(chunks)));
+      }),
+      redirect: 'manual',
+    });
+    const buf = Buffer.from(await r.arrayBuffer());
+    const headers = { 'content-type': r.headers.get('content-type') || 'application/json' };
+    const sc = r.headers.get('set-cookie');
+    if (sc) headers['set-cookie'] = sc;
+    const loc = r.headers.get('location');
+    if (loc) headers.location = loc;
+    res.writeHead(r.status, headers);
+    return res.end(buf);
+  }
   if (req.method === 'GET' && url.pathname === '/health') {
-    return json(200, { ok: true, role: 'verae-staff-session' });
+    return json(200, { ok: true, role: 'verae-staff-session', iam: Boolean(IAM) });
   }
   if (req.method === 'GET' && (url.pathname === '/' || url.pathname === '/login')) {
     res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });