feat(admin): login-as-user impersonation with audit log

Let super admins act as a user from the user detail dashboard for
support/debugging ("full with guardrails", audit-only).

Backend: AuthService.impersonate issues a short-lived token for the
target carrying an `act` claim (acting admin); refresh preserves it and
JwtStrategy surfaces `impersonatedBy`. Guardrails: cannot impersonate an
admin or a deactivated account; new ImpersonationGuard blocks sensitive
self-service (change own password/phone) while impersonating. New
AuditLog entity records impersonation start/stop (admin, target, ip,
time); admin endpoints POST users/:id/impersonate + .../impersonation/
stop and GET users/:id/audit.

Frontend: lib/impersonation swaps admin/impersonation tokens in
localStorage; persistent banner with exit; "Login as user" button and an
"Admin access log" tab on the detail page; logout clears impersonation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/i18n/dictionaries/fa.ts

@@ -868,6 +868,17 @@ const fa = {
         ticketDepts: { technical: 'فنی', sales: 'فروش' },
         ticketPriorities: { low: 'کم', medium: 'متوسط', high: 'زیاد' },
         senderRoles: { user: 'کاربر', admin: 'مدیر', technical: 'پشتیبان فنی', sales: 'کارشناس فروش' },
+        loginAsUser: 'ورود به‌عنوان کاربر',
+        impersonateFailed: 'ورود به‌عنوان کاربر ناموفق بود',
+        impersonatingBanner: 'شما در حال مشاهدهٔ پنل به‌عنوان «{name}» هستید',
+        exitImpersonation: 'خروج از حالت کاربر',
+        tabAudit: 'گزارش ورود ادمین',
+        auditAction: 'رویداد',
+        auditAdmin: 'ادمین',
+        auditTime: 'زمان',
+        auditIp: 'IP',
+        noAudit: 'هیچ ورود ادمینی ثبت نشده.',
+        auditActions: { impersonation_start: 'ورود به‌عنوان کاربر', impersonation_stop: 'خروج از حالت کاربر' },
       },
     },
     pools: {