Close the last three UI leftovers: shared staff HTML, cookie domain, stock Swagger label.

verae-staff-ui holds one review template for CS and access-staff.
Staff cookies take STAFF_COOKIE_DOMAIN for a reverse-proxy host.
/docs stays vendor Swagger with an integrator banner only.

packages/verae-access-staff/src/server.js

@@ -5,6 +5,7 @@ import http from 'node:http';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { listCustomers, withCustomerName } from './names.js';
+import { staffPageHtml } from './staff-page.js';
 
 const PUBLIC = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'public');
 const PORT = Number(process.env.PORT || 3025);
@@ -41,7 +42,16 @@ const server = http.createServer(async (req, res) => {
         }
       }
       res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
-      res.end(fs.readFileSync(path.join(PUBLIC, 'index.html')));
+      res.end(
+        await staffPageHtml(
+          {
+            title: 'Staff access',
+            kicker: 'staff plane · after authz',
+            lede: 'CS / sales / accounting door. Review and credit go through authz, then account-balance. Amounts are dollars.',
+          },
+          path.join(PUBLIC, 'index.html'),
+        ),
+      );
       return;
     }
     if (req.method === 'GET' && url.pathname === '/health') {

packages/verae-access-staff/src/staff-page.js

@@ -0,0 +1,16 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+export async function staffPageHtml(opts, fallbackPath) {
+  const sibling = path.join(path.dirname(fallbackPath), '..', '..', 'verae-staff-ui', 'src', 'load.js');
+  try {
+    if (fs.existsSync(sibling)) {
+      const { loadReviewHtml } = await import(pathToFileURL(sibling).href);
+      return loadReviewHtml(opts, fallbackPath);
+    }
+  } catch {
+    /* standalone clone */
+  }
+  return fs.readFileSync(fallbackPath, 'utf8');
+}