Close the last three UI leftovers: shared staff HTML, cookie domain, stock Swagger label.

verae-staff-ui holds one review template for CS and access-staff.
Staff cookies take STAFF_COOKIE_DOMAIN for a reverse-proxy host.
/docs stays vendor Swagger with an integrator banner only.

packages/verae-access-staff/src/server.js

@@ -5,6 +5,7 @@ import http from 'node:http';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { listCustomers, withCustomerName } from './names.js';
+import { staffPageHtml } from './staff-page.js';
 
 const PUBLIC = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'public');
 const PORT = Number(process.env.PORT || 3025);
@@ -41,7 +42,16 @@ const server = http.createServer(async (req, res) => {
         }
       }
       res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
-      res.end(fs.readFileSync(path.join(PUBLIC, 'index.html')));
+      res.end(
+        await staffPageHtml(
+          {
+            title: 'Staff access',
+            kicker: 'staff plane · after authz',
+            lede: 'CS / sales / accounting door. Review and credit go through authz, then account-balance. Amounts are dollars.',
+          },
+          path.join(PUBLIC, 'index.html'),
+        ),
+      );
       return;
     }
     if (req.method === 'GET' && url.pathname === '/health') {