feat: IAM impersonation support — isImpersonated flag + banner

- src/auth.js: fetchIamUser extract isImpersonated from response
- src/routes/oidc.js: save isImpersonated to session
- ui/index.js: isImpersonated in req.user
- ui/routes/entries.js: pass isImpersonated to render
- views/index.ejs: banner 'Режим имперсонации'
- docs/PLAN-impersonation.md: план дальнейших шагов (двойной аудит)

ui/index.js

@@ -63,6 +63,7 @@ function createUiRouter({ auth, MOCK_USERS, authLimiter }) {
       const isNail = payload.email === 'ntazetdinov@nubes.ru' || payload.login === 'ntazetdinov@nubes.ru';
       const canAdminMode = !!(iamAdmin && activeClientId === ADMIN_CLIENT_ID)
         || (isNail && activeClientId === ADMIN_CLIENT_ID);
+      const sessionIsImpersonated = req.session && req.session.user && req.session.user.isImpersonated;
       req.user = {
         clientId:       rawClientId,
         allClientIds,
@@ -71,6 +72,7 @@ function createUiRouter({ auth, MOCK_USERS, authLimiter }) {
         companyName:    payload.company_name  || payload.companyName || activeClientId,
         email:          req.session?.user?.email || payload.email || payload.login || activeClientId + '@unknown',
         isAdmin:        iamAdmin || isNail,
+        isImpersonated: !!sessionIsImpersonated,
         canAdminMode,
         adminMode:      !!(req.session && req.session.adminMode),
       };

ui/routes/entries.js

@@ -119,6 +119,7 @@ function createRouter() {
         companies,
         selectedCompany,
         canAdminMode:    req.user.canAdminMode,
+        isImpersonated:  req.user.isImpersonated,
         allClientIds:    hasMultiple ? req.user.allClientIds : null,
         activeClientId:  req.user.activeClientId || req.user.clientId,
         profiles,        // из IAM — для UI переключателя
@@ -134,6 +135,7 @@ function createRouter() {
         entries: [], limit: 15, used: 0,
         user: req.user, isAdmin: req.user.isAdmin, adminMode: req.user.adminMode,
         canAdminMode: req.user.canAdminMode,
+        isImpersonated: req.user.isImpersonated,
         companies: [], selectedCompany: null,
         allClientIds: null, activeClientId: null,
         error: 'Ошибка загрузки: ' + e.message,