verae-staff-iam/SUMMARY.md

verae-staff-iam

Internal staff directory: users, roles, permissions, sessions, audit. Not customer portal accounts.

Security: optional TOTP per user; STAFF_TOTP_REQUIRED=1 forces enroll before full access (TOTP.md); optional mTLS enforce via proxy headers only. Device-cert surface: GET /enroll/status state + nextSteps[] + updatedAt + proxyHeadersSeen + ENROLL.md — no fake PKI / no mint crypto.

Test: npm test (login, TOTP policy, mTLS enforce, enroll states).