feat: IAM impersonation support — isImpersonated flag + banner

- src/auth.js: fetchIamUser extract isImpersonated from response
- src/routes/oidc.js: save isImpersonated to session
- ui/index.js: isImpersonated in req.user
- ui/routes/entries.js: pass isImpersonated to render
- views/index.ejs: banner 'Режим имперсонации'
- docs/PLAN-impersonation.md: план дальнейших шагов (двойной аудит)

ui/index.js

@@ -63,6 +63,7 @@ function createUiRouter({ auth, MOCK_USERS, authLimiter }) {
       const isNail = payload.email === 'ntazetdinov@nubes.ru' || payload.login === 'ntazetdinov@nubes.ru';
       const canAdminMode = !!(iamAdmin && activeClientId === ADMIN_CLIENT_ID)
         || (isNail && activeClientId === ADMIN_CLIENT_ID);
+      const sessionIsImpersonated = req.session && req.session.user && req.session.user.isImpersonated;
       req.user = {
         clientId:       rawClientId,
         allClientIds,
@@ -71,6 +72,7 @@ function createUiRouter({ auth, MOCK_USERS, authLimiter }) {
         companyName:    payload.company_name  || payload.companyName || activeClientId,
         email:          req.session?.user?.email || payload.email || payload.login || activeClientId + '@unknown',
         isAdmin:        iamAdmin || isNail,
+        isImpersonated: !!sessionIsImpersonated,
         canAdminMode,
         adminMode:      !!(req.session && req.session.adminMode),
       };