feat: full IAM impersonation support — read-only + original user + canWrite

- src/auth.js: all impersonation fields + permissions.can_write
- src/routes/oidc.js: save all fields to session
- ui/index.js: canWrite, originalUserEmail in req.user
- ui/routes/entries.js: read-only guard on POST/PATCH/DELETE
- docs/PLAN-impersonation.md: updated with implemented items

ui/routes/entries.js

@@ -120,6 +120,8 @@ function createRouter() {
         selectedCompany,
         canAdminMode:    req.user.canAdminMode,
         isImpersonated:  req.user.isImpersonated,
+        originalUserEmail: req.user.originalUserEmail,
+        canWrite:        req.user.canWrite,
         allClientIds:    hasMultiple ? req.user.allClientIds : null,
         activeClientId:  req.user.activeClientId || req.user.clientId,
         profiles,        // из IAM — для UI переключателя
@@ -136,6 +138,8 @@ function createRouter() {
         user: req.user, isAdmin: req.user.isAdmin, adminMode: req.user.adminMode,
         canAdminMode: req.user.canAdminMode,
         isImpersonated: req.user.isImpersonated,
+        originalUserEmail: req.user.originalUserEmail,
+        canWrite: req.user.canWrite,
         companies: [], selectedCompany: null,
         allClientIds: null, activeClientId: null,
         error: 'Ошибка загрузки: ' + e.message,
@@ -147,6 +151,7 @@ function createRouter() {
 
   // POST /add — создать запись
   router.post('/add', async (req, res) => {
+    if (req.user && !req.user.canWrite) return res.status(403).send('Read-only mode');
     const token = api.token(req);
     const { value, comment } = req.body;
     const cq   = companyQuery(req);
@@ -172,6 +177,7 @@ function createRouter() {
 
   // POST /edit/:id — обновить запись
   router.post('/edit/:id', async (req, res) => {
+    if (req.user && !req.user.canWrite) return res.status(403).send('Read-only mode');
     const token = api.token(req);
     const { value, comment } = req.body;
     const cq   = companyQuery(req);
@@ -194,6 +200,7 @@ function createRouter() {
 
   // POST /delete/:id — удалить запись
   router.post('/delete/:id', async (req, res) => {
+    if (req.user && !req.user.canWrite) return res.status(403).send('Read-only mode');
     const token = api.token(req);
     const cq   = companyQuery(req);
     const back = backUrl(req);