* Fix STS Access Denied for AssumeRoleWithWebIdentity (Issue #7917)
* Fix logging regression: ensure IAM status is logged even if STS is enabled
* Address PR feedback: fix duplicate log, clarify comments, add comprehensive routing tests
* Add edge case test: authenticated STS action routes to IAM (auth precedence)