feat(passenger-api): integrate @tria-plc IAM package (dual-ORM iam schema + package auth guard)

apps/edr-passenger-api/src/modules/notifications/notifications.controller.ts

@@ -2,7 +2,6 @@ import { Controller, Get, Param, Patch, Post, Body, UseGuards } from '@nestjs/co
 import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger';
 import { NotificationsService } from './notifications.service';
 import { JwtGuard } from '../../common/jwt.guard';
-import { IamGuard, IamRoles } from '../../common/iam-adapter';
 import { TestNotificationDto } from './notifications.dto';
 
 @ApiTags('Notifications')
@@ -31,8 +30,8 @@ export class NotificationsController {
   }
 
   @Post('test')
-  @UseGuards(IamGuard)
-  @IamRoles('ADMIN', 'STAFF')
+  // TODO(iam-authz): restrict to admin/staff via IAM PermissionGuard once role→permission mapping
+  // is confirmed. Currently protected by the class-level JwtGuard only.
   @ApiOperation({ summary: 'Test notification delivery (Admin only)' })
   async testNotification(@Body() dto: TestNotificationDto) {
     return this.service.send(