fix: X-Imp-* headers bridge UI→API impersonation + timezone GMT+4

src/auth.js

@@ -445,6 +445,22 @@ function createBearerMiddleware(isOidc, devMode) {
     try {
       const payload = verifyAnyToken(bearer, devMode);
       req.user = userFromPayload(payload);
+
+      // Проброс контекста имперсонации из UI-слоя (X-Imp-* заголовки)
+      // Устанавливаются ui/api-client.js → api.impHeaders()
+      const impEmail    = req.headers['x-imp-email']    || '';
+      const impOrig     = req.headers['x-imp-originalemail'] || '';
+      const impClientId = req.headers['x-imp-clientid'] || '';
+      if (impEmail) {
+        req.user.email           = impEmail;
+        req.user.originalUserEmail = impOrig;
+        req.user.isImpersonated  = true;
+        if (impClientId) {
+          req.user.clientId      = impClientId;
+          req.user.activeClientId = impClientId;
+        }
+      }
+
       return next();
     } catch (e) {
       return res.status(401).json({ error: 'Invalid token: ' + e.message });