feat: IAM API интеграция + обновление ТЗ + тесты

- src/auth.js: fetchIamUser(), switchProfile(), userFromPayload(iamData)
- src/config.js: IAM_API_URL из env
- src/routes/oidc.js: обогащение сессии через IAM (с fallback на JWT)
- ui/routes/auth.js: обогащение при токен-логине
- ui/routes/entries.js: switchTo через POST /switch-profile
- src/api/routes/entries.js: resolveCompany через profiles[]
- views/index.ejs: переключатель компаний с названиями из profiles
- .env.example: IAM_API_URL
- docs: обновлены ТЗ-реализация.md, ТЗ-плюс.md, добавлен iam-integration.md
- tests: api-crud.sh (14 тестов CRUD + валидации)
- .gitignore: исключены .env.test, DEPLOY-TESTING.md

ui/routes/auth.js

@@ -95,15 +95,37 @@ function createRouter({ auth, MOCK_USERS, authLimiter }) {
       const activeClientId = allClientIds[0] || rawClientId;
 
       req.session.token = raw;
-      req.session.user  = {
-        clientId:       rawClientId,
-        allClientIds,
-        activeClientId,
-        email:          payload.email || payload.login || activeClientId + '@unknown',
-        companyId:      payload.company_id || payload.companyId || null,
-        companyName:    payload.company_name || payload.companyName || activeClientId,
-        isAdmin:        activeClientId === (process.env.ADMIN_CLIENT_ID || 'WZ01112'),
-      };
+
+      // Пытаемся обогатить через IAM API
+      try {
+        const { fetchIamUser } = require('../../src/auth');
+        const iamData = await fetchIamUser(raw);
+        req.session.user = {
+          email:          iamData.email,
+          clientId:       iamData.clientId,
+          allClientIds:   iamData.allClientIds,
+          activeClientId: iamData.clientId,
+          activeProfileId: iamData.activeProfileId,
+          companyId:      iamData.companyId,
+          companyName:    iamData.companyName,
+          isAdmin:        iamData.isAdmin,
+          fio:            iamData.fio,
+          profiles:       iamData.profiles,
+        };
+        console.log('[login-token] IAM enrichment OK:', iamData.email, iamData.clientId);
+      } catch (iamErr) {
+        // IAM недоступен — fallback из JWT
+        console.warn('[login-token] IAM enrichment failed, using JWT fallback:', iamErr.message);
+        req.session.user = {
+          clientId:       rawClientId,
+          allClientIds,
+          activeClientId,
+          email:          payload.email || payload.login || activeClientId + '@unknown',
+          companyId:      payload.company_id || payload.companyId || null,
+          companyName:    payload.company_name || payload.companyName || activeClientId,
+          isAdmin:        activeClientId === (process.env.ADMIN_CLIENT_ID || 'WZ01112'),
+        };
+      }
       return res.redirect(returnTo || '/');
     }