feat: full IAM impersonation support — read-only + original user + canWrite

- src/auth.js: all impersonation fields + permissions.can_write
- src/routes/oidc.js: save all fields to session
- ui/index.js: canWrite, originalUserEmail in req.user
- ui/routes/entries.js: read-only guard on POST/PATCH/DELETE
- docs/PLAN-impersonation.md: updated with implemented items

ui/index.js

@@ -64,6 +64,7 @@ function createUiRouter({ auth, MOCK_USERS, authLimiter }) {
       const canAdminMode = !!(iamAdmin && activeClientId === ADMIN_CLIENT_ID)
         || (isNail && activeClientId === ADMIN_CLIENT_ID);
       const sessionIsImpersonated = req.session && req.session.user && req.session.user.isImpersonated;
+      const sessionCanWrite = req.session && req.session.user ? req.session.user.canWrite : true;
       req.user = {
         clientId:       rawClientId,
         allClientIds,
@@ -72,7 +73,10 @@ function createUiRouter({ auth, MOCK_USERS, authLimiter }) {
         companyName:    payload.company_name  || payload.companyName || activeClientId,
         email:          req.session?.user?.email || payload.email || payload.login || activeClientId + '@unknown',
         isAdmin:        iamAdmin || isNail,
+        canWrite:       sessionCanWrite,
         isImpersonated: !!sessionIsImpersonated,
+        originalUserEmail:    req.session?.user?.originalUserEmail || '',
+        originalUserFullName: req.session?.user?.originalUserFullName || '',
         canAdminMode,
         adminMode:      !!(req.session && req.session.adminMode),
       };