feat: full IAM impersonation support — read-only + original user + canWrite

- src/auth.js: all impersonation fields + permissions.can_write
- src/routes/oidc.js: save all fields to session
- ui/index.js: canWrite, originalUserEmail in req.user
- ui/routes/entries.js: read-only guard on POST/PATCH/DELETE
- docs/PLAN-impersonation.md: updated with implemented items

package.json

@@ -1,6 +1,6 @@
 {
   "name": "ipwhitelist",
-  "version": "0.5.52",
+  "version": "0.5.53",
   "description": "IP WhiteList microservice for cloud provider",
   "main": "server.js",
   "scripts": {