docs: PR body for feature/staff-role-switcher

Add docs/PR-staff-role-switcher.md for the UI branch; link ENROLL, TOTP,
and PKI READY packs in sibling verae-staff-iam plus companion IAM PR body.

docs/PR-staff-role-switcher.md

@@ -0,0 +1,70 @@
+# PR: feature/staff-role-switcher (verae-staff-ui)
+
+**Repo:** `verae-staff-ui`  
+**Branch:** `feature/staff-role-switcher` → `main`  
+**Forgejo:** https://git.georgelambert.org/marchon/verae-staff-ui  
+**Companion PR:** `verae-staff-iam` same branch (`docs/PR-staff-role-switcher.md`)
+
+Paste this body (or link this file) when opening the Forgejo pull request.
+
+## Summary
+
+Shared staff review UI picks up the **2026 brand kit**, a top-right **role interface switcher** (calls IAM `POST /session/role`), hash lookup panel polish, and operator docs that point at **ENROLL**, **TOTP**, and **PKI READY** packs in sibling `verae-staff-iam`.
+
+## Why
+
+- CS and access-staff share one review template; multi-role operators need the same Interface chrome as IAM app.html.
+- Review hosts must stay plum-branded and must not emit customer `xVerae-` token keys.
+- Operators opening staff-ui need one place to find enroll / 2FA / production PKI refuse docs.
+
+## What landed (vs `main`)
+
+### Role switcher
+- [`public/role-switcher.js`](../public/role-switcher.js) — mounts when capabilities ≥ 2; `GET /me` + `POST /session/role` against IAM origin (`meta[name=staff-iam]` or `iam.<base>`)
+- Wired from review / load path so department doors inherit chrome
+
+### Brand + review
+- `public/brand/tokens.css` + `public/verae-ui-kit.css`
+- `public/review.html` — 2026 kit, hash lookup panel
+- `src/load.js` inlines brand kit for hosts that only emit HTML
+
+### Operator docs
+- [`docs/README.md`](./README.md) links sibling IAM ENROLL / TOTP / PRODUCTION-PKI-REFUSE and edge SUPPORT
+
+## Link: ENROLL · TOTP · PKI READY packs
+
+Paths are monorepo-relative from this package (`../../verae-staff-iam/…`). On Forgejo, open the companion IAM PR or clone `verae-staff-iam` on the same branch.
+
+| Pack | Sibling path | Role |
+|------|--------------|------|
+| **ENROLL** | [`verae-staff-iam/ENROLL.md`](../../verae-staff-iam/ENROLL.md) | Device cert mTLS status + CSR scaffold (default 501) |
+| **TOTP** | [`verae-staff-iam/TOTP.md`](../../verae-staff-iam/TOTP.md) | Staff authenticator + `STAFF_TOTP_REQUIRED` |
+| **PROD-CA cutover (READY)** | [`docs/PROD-CA-CUTOVER-RUNBOOK.md`](../../verae-staff-iam/docs/PROD-CA-CUTOVER-RUNBOOK.md) | Production CA mint/renew/revoke cutover (ops) |
+| **AuthZ enroll (READY)** | [`docs/AUTHZ-ENROLL-DESIGN.md`](../../verae-staff-iam/docs/AUTHZ-ENROLL-DESIGN.md) | Design before real AuthZ mint path |
+| **CRL/OCSP deploy (READY)** | [`docs/CRL-OCSP-DEPLOY-CHECKLIST.md`](../../verae-staff-iam/docs/CRL-OCSP-DEPLOY-CHECKLIST.md) | Production CRL/OCSP deploy checklist |
+| Refuse matrix | [`docs/PRODUCTION-PKI-REFUSE.md`](../../verae-staff-iam/docs/PRODUCTION-PKI-REFUSE.md) | Lab 201 vs prod 501; no live mint in IAM |
+| IAM PR body | [`docs/PR-staff-role-switcher.md`](../../verae-staff-iam/docs/PR-staff-role-switcher.md) | Full IAM change list + invariants |
+
+Staff-ui does **not** mint certs or run TOTP crypto; it only consumes IAM session/role APIs and documents the operator path.
+
+## Test plan
+
+```sh
+cd verae-staff-ui
+npm test
+# expect: 2/2 pass (title fill + plum brand kit inline, no customer token key)
+```
+
+Manual: load review HTML with `STAFF_IAM_URL` / `meta staff-iam` pointing at a running IAM on `feature/staff-role-switcher`; multi-role user shows Interface dropdown.
+
+## Merge notes
+
+- Merge **with** `verae-staff-iam` `feature/staff-role-switcher` so `/session/role` and catalog exist.
+- Monorepo hosts that copy `packages/verae-staff-ui/public/review.html` should pick up brand + switcher together.
+- No production PKI behavior changes in this package.
+
+## Out of scope
+
+- IAM server logic (see companion PR)
+- Edge support APIs (see `zappier-edge` SUPPORT)
+- Customer portal UI

docs/README.md

@@ -24,6 +24,8 @@ Operator references (sibling packages):
 - [Staff authenticator (TOTP)](../../verae-staff-iam/TOTP.md) — `staff-iam` TOTP setup / `STAFF_TOTP_REQUIRED`
 - [Production PKI refuse matrix](../../verae-staff-iam/docs/PRODUCTION-PKI-REFUSE.md) — lab-only 201 vs production 501; no live mint
 - [Staff support APIs](../../zappier-edge/SUPPORT.md) — `zappier-edge` `/admin/api/support/*` for CS diagnosis
+- [PR body — staff-role-switcher](./PR-staff-role-switcher.md) — branch PR for UI + links to IAM ENROLL/TOTP/PKI READY
+- PKI READY packs (sibling IAM): [PROD-CA-CUTOVER-RUNBOOK](../../verae-staff-iam/docs/PROD-CA-CUTOVER-RUNBOOK.md), [AUTHZ-ENROLL-DESIGN](../../verae-staff-iam/docs/AUTHZ-ENROLL-DESIGN.md), [CRL-OCSP-DEPLOY-CHECKLIST](../../verae-staff-iam/docs/CRL-OCSP-DEPLOY-CHECKLIST.md)
 
 ## Contributing