feat(admin): login-as-user impersonation with audit log

Let super admins act as a user from the user detail dashboard for
support/debugging ("full with guardrails", audit-only).

Backend: AuthService.impersonate issues a short-lived token for the
target carrying an `act` claim (acting admin); refresh preserves it and
JwtStrategy surfaces `impersonatedBy`. Guardrails: cannot impersonate an
admin or a deactivated account; new ImpersonationGuard blocks sensitive
self-service (change own password/phone) while impersonating. New
AuditLog entity records impersonation start/stop (admin, target, ip,
time); admin endpoints POST users/:id/impersonate + .../impersonation/
stop and GET users/:id/audit.

Frontend: lib/impersonation swaps admin/impersonation tokens in
localStorage; persistent banner with exit; "Login as user" button and an
"Admin access log" tab on the detail page; logout clears impersonation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/i18n/dictionaries/en.ts

@@ -869,6 +869,17 @@ const en: Dictionary = {
         ticketDepts: { technical: 'Technical', sales: 'Sales' },
         ticketPriorities: { low: 'Low', medium: 'Medium', high: 'High' },
         senderRoles: { user: 'User', admin: 'Admin', technical: 'Technical support', sales: 'Sales' },
+        loginAsUser: 'Login as user',
+        impersonateFailed: 'Failed to start impersonation',
+        impersonatingBanner: 'You are viewing the panel as "{name}"',
+        exitImpersonation: 'Exit user mode',
+        tabAudit: 'Admin access log',
+        auditAction: 'Event',
+        auditAdmin: 'Admin',
+        auditTime: 'Time',
+        auditIp: 'IP',
+        noAudit: 'No admin access recorded.',
+        auditActions: { impersonation_start: 'Logged in as user', impersonation_stop: 'Exited user mode' },
       },
     },
     pools: {