Answer
Two things commonly need fixing for CRM Panel specifically. First, check the Web API's Client Application setup (the 'IFS Apps10 - Server Application' entry) — the user_impersonation scope needs to be explicitly selected there; the openid scope alone isn't sufficient for CRM Panel's authentication flow to actually complete, even though it's enough for IEE/Aurena. Second, once authentication itself works, make sure the user's permission set includes the RmPanelHandling and RmPanelNavigator projections — set this permission set up in IEE rather than Aurena (a 'Grant All' action in Aurena wasn't found to correctly propagate this), and manually select every function underneath the main option individually, since selecting just the top-level item alone doesn't automatically select its sub-functions.