Add docs/PR-staff-role-switcher.md covering role interface, TOTP/enroll,
and links to ENROLL, TOTP, and PKI READY packs (PROD-CA cutover, AuthZ
enroll design, CRL/OCSP deploy). Link from README Docs table.
Invite accounts default mustChangePassword=true; POST /password/change
clears the flag and offers optional TOTP; GET /check returns 403
must_change_password until change. Admin POST /admin/mark-must-change
re-marks owner invites. Also POST /2fa/skip. Fixes password-totp tests
(port 18039). All 19 npm tests green including health PKI/lab matrix.
Add Account Security UI with password change, authenticator enrollment,
and a reserved client-certificate mint slot (window.StaffIamSecurity.onCertMount)
so the parallel mTLS login work can wire without clobbering force-change/TOTP.
JSON APIs (/check etc.) return 403 must_change_password rather than HTML 302
so department doors can redirect cleanly.
New staff accounts default to mustChangePassword=true. After login,
/check and staff doors return 403 must_change_password until
POST /password/change succeeds; then /enroll-2fa offers optional
authenticator setup (skip allowed). Login requires totpCode when
enabled. Admin POST /admin/mark-must-change re-marks invite owners.
- IAM sessions carry capabilities[] + currentRole; POST /session/role switches
- ROLE_INTERFACES map roles to CS/Sales/Acct/Admin/Fleet door URLs
- CORS for *.zapier.georgelambert.org so staff UIs can call IAM
- Top-right Interface dropdown when user has >=2 capabilities
- Admin People & roles UI already assigns roles; clarified framing
- Shared switcher in verae-staff-ui; fallbacks in CS/Sales/Acct/staff plane
