Add internal staff IAM: named users, roles, and management permissions.

verae-staff-iam (:3028) is the people directory — owner, billing-admin,
cs, sales, accounting, operator, viewer — with scrypt passwords, sessions,
and an audit log. Admin console login uses it when STAFF_IAM_URL is set
and hides tabs the account cannot use. CS/sales/accounting/staff/fleet
check permissions such as cs.credit and fleet.operate. Shared staff key
remains only as a fallback when IAM is unset.

scripts/build-docs-site.py

@@ -367,6 +367,7 @@ def main() -> None:
         "ui-docs",
         "verae-staff-session",
         "verae-staff-ui",
+        "verae-staff-iam",
     ):
         pkg_root = ROOT / "packages" / pkg
         if pkg in {"zapier-user-docs", "overview", "docs-master", "verae-ops"}:

scripts/gen-module-docs.py

@@ -70,6 +70,7 @@ REPO_READMES = [
     "ui-docs",
     "verae-staff-session",
     "verae-staff-ui",
+    "verae-staff-iam",
 ]
 
 SKIP_PARTS = {"test", "tests", "node_modules", "dist"}

scripts/push-module-repos.sh

@@ -67,6 +67,7 @@ create zapier-decisions "Architecture decisions and action log"
 create UI-Docs "UI walkthrough, screenshots, and review PDF"
 create verae-staff-session "Shared staff cookie login for department HTML"
 create verae-staff-ui "Shared staff review HTML template"
+create verae-staff-iam "Internal staff users, roles, and permissions"
 
 push_dir "$ROOT/packages/zappier" zappier-edge
 push_dir "$ROOT/packages/verae-zapier-middleware" verae-middleware
@@ -100,5 +101,6 @@ push_dir "$ROOT/packages/zapier-decisions" zapier-decisions
 push_dir "$ROOT/packages/ui-docs" UI-Docs
 push_dir "$ROOT/packages/verae-staff-session" verae-staff-session
 push_dir "$ROOT/packages/verae-staff-ui" verae-staff-ui
+push_dir "$ROOT/packages/verae-staff-iam" verae-staff-iam
 
 echo ALL_MODULE_REPOS_PUSHED