Answer
Grant access to the crystal_web_util_api package to the IFSSYS user specifically — this resolved this exact symptom. It's not something obviously implied by the standard Crystal report setup guidelines, but the framework's own internal proxy user needs this specific package access to properly handle Crystal Quick Report execution without falling back to prompting the end user for IFSAPP credentials.