feat: IAM impersonation support — isImpersonated flag + banner

- src/auth.js: fetchIamUser extract isImpersonated from response
- src/routes/oidc.js: save isImpersonated to session
- ui/index.js: isImpersonated in req.user
- ui/routes/entries.js: pass isImpersonated to render
- views/index.ejs: banner 'Режим имперсонации'
- docs/PLAN-impersonation.md: план дальнейших шагов (двойной аудит)

src/auth.js

@@ -321,6 +321,7 @@ async function fetchIamUser(token) {
     companyId:      ui.companyId || '',
     companyName:    ui.company || activeProfile.company_name || '',
     isAdmin:        !!ui.isAdmin,
+    isImpersonated: !!(raw.impersonation && raw.impersonation.is_impersonated),
     fio:            ui.fio || null,
     profiles,       // полный массив для UI
     raw,            // сырой ответ (для отладки)