feat: full IAM impersonation support — read-only + original user + canWrite

- src/auth.js: all impersonation fields + permissions.can_write
- src/routes/oidc.js: save all fields to session
- ui/index.js: canWrite, originalUserEmail in req.user
- ui/routes/entries.js: read-only guard on POST/PATCH/DELETE
- docs/PLAN-impersonation.md: updated with implemented items

src/auth.js

@@ -312,6 +312,8 @@ async function fetchIamUser(token) {
   const profiles = raw.profiles || [];
   const activeProfile = profiles.find(p => p.is_active_profile) || profiles[0] || {};
   const ui = raw.userInfo || {};
+  const imp = raw.impersonation || {};
+  const perms = raw.permissions || {};
 
   return {
     email:          ui.email || '',
@@ -321,7 +323,13 @@ async function fetchIamUser(token) {
     companyId:      ui.companyId || '',
     companyName:    ui.company || activeProfile.company_name || '',
     isAdmin:        !!ui.isAdmin,
-    isImpersonated: !!(raw.impersonation && raw.impersonation.is_impersonated),
+    canWrite:       perms.can_write !== false,
+    isImpersonated: !!(imp.is_impersonated),
+    impersonationType:     imp.type || null,
+    originalUserEmail:     imp.originalUserEmail || '',
+    originalUserFullName:  imp.originalUserFullName || '',
+    originalUserCompany:   imp.originalUserCompany || '',
+    impersonatedCompanyId: imp.impersonatedCompanyId || '',
     fio:            ui.fio || null,
     profiles,       // полный массив для UI
     raw,            // сырой ответ (для отладки)