feat(admin): login-as-user impersonation with audit log

Let super admins act as a user from the user detail dashboard for
support/debugging ("full with guardrails", audit-only).

Backend: AuthService.impersonate issues a short-lived token for the
target carrying an `act` claim (acting admin); refresh preserves it and
JwtStrategy surfaces `impersonatedBy`. Guardrails: cannot impersonate an
admin or a deactivated account; new ImpersonationGuard blocks sensitive
self-service (change own password/phone) while impersonating. New
AuditLog entity records impersonation start/stop (admin, target, ip,
time); admin endpoints POST users/:id/impersonate + .../impersonation/
stop and GET users/:id/audit.

Frontend: lib/impersonation swaps admin/impersonation tokens in
localStorage; persistent banner with exit; "Login as user" button and an
"Admin access log" tab on the detail page; logout clears impersonation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/admin/admin.module.ts

@@ -1,24 +1,31 @@
 import { Module } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
 import { AdminUsersController } from './admin-users.controller';
 import { AdminUsersService } from './admin-users.service';
+import { AuditLog } from './entities/audit-log.entity';
 import { UsersModule } from '../users/users.module';
 import { BillingModule } from '../billing/billing.module';
 import { ApplicationsModule } from '../applications/applications.module';
 import { DeploymentsModule } from '../deployments/deployments.module';
 import { TicketsModule } from '../tickets/tickets.module';
+import { AuthModule } from '../auth/auth.module';
 
 /**
  * Super-admin aggregation module. Imports the domain modules (which export
  * their services) so the admin controller can read everything about a user
- * without re-implementing per-module logic.
+ * without re-implementing per-module logic. Also owns the audit log and the
+ * impersonation ("login as user") entrypoint, which delegates token minting to
+ * AuthService.
  */
 @Module({
   imports: [
+    TypeOrmModule.forFeature([AuditLog]),
     UsersModule,
     BillingModule,
     ApplicationsModule,
     DeploymentsModule,
     TicketsModule,
+    AuthModule,
   ],
   controllers: [AdminUsersController],
   providers: [AdminUsersService],