feat: IAM impersonation support — isImpersonated flag + banner

- src/auth.js: fetchIamUser extract isImpersonated from response
- src/routes/oidc.js: save isImpersonated to session
- ui/index.js: isImpersonated in req.user
- ui/routes/entries.js: pass isImpersonated to render
- views/index.ejs: banner 'Режим имперсонации'
- docs/PLAN-impersonation.md: план дальнейших шагов (двойной аудит)

ui/routes/entries.js

@@ -119,6 +119,7 @@ function createRouter() {
         companies,
         selectedCompany,
         canAdminMode:    req.user.canAdminMode,
+        isImpersonated:  req.user.isImpersonated,
         allClientIds:    hasMultiple ? req.user.allClientIds : null,
         activeClientId:  req.user.activeClientId || req.user.clientId,
         profiles,        // из IAM — для UI переключателя
@@ -134,6 +135,7 @@ function createRouter() {
         entries: [], limit: 15, used: 0,
         user: req.user, isAdmin: req.user.isAdmin, adminMode: req.user.adminMode,
         canAdminMode: req.user.canAdminMode,
+        isImpersonated: req.user.isImpersonated,
         companies: [], selectedCompany: null,
         allClientIds: null, activeClientId: null,
         error: 'Ошибка загрузки: ' + e.message,