feat(admin): login-as-user impersonation with audit log

Let super admins act as a user from the user detail dashboard for
support/debugging ("full with guardrails", audit-only).

Backend: AuthService.impersonate issues a short-lived token for the
target carrying an `act` claim (acting admin); refresh preserves it and
JwtStrategy surfaces `impersonatedBy`. Guardrails: cannot impersonate an
admin or a deactivated account; new ImpersonationGuard blocks sensitive
self-service (change own password/phone) while impersonating. New
AuditLog entity records impersonation start/stop (admin, target, ip,
time); admin endpoints POST users/:id/impersonate + .../impersonation/
stop and GET users/:id/audit.

Frontend: lib/impersonation swaps admin/impersonation tokens in
localStorage; persistent banner with exit; "Login as user" button and an
"Admin access log" tab on the detail page; logout clears impersonation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/types/index.ts

@@ -568,6 +568,22 @@ export interface AdminActivityEvent {
   meta: Record<string, any>;
 }
 
+export interface AdminAuditEntry {
+  id: string;
+  action: 'impersonation_start' | 'impersonation_stop' | string;
+  actorUserId: string;
+  actorName?: string | null;
+  ip?: string | null;
+  createdAt: string;
+}
+
+export interface ImpersonateResponse {
+  user: User;
+  accessToken: string;
+  refreshToken: string;
+  impersonation: { by: string; at: string };
+}
+
 export interface ClusterNode {
   name: string;
   status: string;