feat(admin): login-as-user impersonation with audit log

Let super admins act as a user from the user detail dashboard for
support/debugging ("full with guardrails", audit-only).

Backend: AuthService.impersonate issues a short-lived token for the
target carrying an `act` claim (acting admin); refresh preserves it and
JwtStrategy surfaces `impersonatedBy`. Guardrails: cannot impersonate an
admin or a deactivated account; new ImpersonationGuard blocks sensitive
self-service (change own password/phone) while impersonating. New
AuditLog entity records impersonation start/stop (admin, target, ip,
time); admin endpoints POST users/:id/impersonate + .../impersonation/
stop and GET users/:id/audit.

Frontend: lib/impersonation swaps admin/impersonation tokens in
localStorage; persistent banner with exit; "Login as user" button and an
"Admin access log" tab on the detail page; logout clears impersonation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/common/guards/impersonation.guard.ts

@@ -0,0 +1,27 @@
+import {
+  Injectable,
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+} from '@nestjs/common';
+
+/**
+ * Blocks sensitive self-service actions while an admin is impersonating the
+ * user (token carries an `act` claim, surfaced as `req.user.impersonatedBy`).
+ * Apply to endpoints like changing one's own password/phone — operations an
+ * admin acting "as" a user must never perform on their behalf.
+ *
+ * Runs after AuthGuard('jwt'), so `req.user` is already populated.
+ */
+@Injectable()
+export class ImpersonationGuard implements CanActivate {
+  canActivate(context: ExecutionContext): boolean {
+    const { user } = context.switchToHttp().getRequest();
+    if (user?.impersonatedBy) {
+      throw new ForbiddenException(
+        'This action is not allowed while impersonating a user',
+      );
+    }
+    return true;
+  }
+}