- IAM sessions carry capabilities[] + currentRole; POST /session/role switches
- ROLE_INTERFACES map roles to CS/Sales/Acct/Admin/Fleet door URLs
- CORS for *.zapier.georgelambert.org so staff UIs can call IAM
- Top-right Interface dropdown when user has >=2 capabilities
- Admin People & roles UI already assigns roles; clarified framing
- Shared switcher in verae-staff-ui; fallbacks in CS/Sales/Acct/staff plane