feat: replace token-based impersonation with enterprise-grade header-based system

Replaces the insecure token-in-localStorage approach with a header-based
impersonation system backed by cache sessions and MFA verification.

Key changes:
- New impersonation_sessions audit table (immutable, ULID PK)
- MFA verification required to start impersonation (TOTP/email/backup)
- X-Impersonate-User header + HandleImpersonation middleware
- Per-request auth context swap (admin session never modified)
- IP pinning, sensitive route blocking, no nesting, sliding 60-min TTL
- Activity log auto-tagged with impersonated_by during sessions
- Frontend: sessionStorage, BroadcastChannel sync, countdown timer
- ImpersonateDialog with reason + MFA verification flow
- 26 comprehensive tests covering core, middleware, audit, lifecycle

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/app/src/lib/axios.ts

@@ -21,6 +21,21 @@ apiClient.interceptors.request.use(
       config.headers['X-Organisation-Id'] = orgStore.activeOrganisationId
     }
 
+    // Add impersonation header when active
+    // Lazy import to avoid circular dependency with store
+    const impersonationData = sessionStorage.getItem('crewli_impersonation')
+    if (impersonationData) {
+      try {
+        const parsed = JSON.parse(impersonationData) as { targetUserId?: string }
+        if (parsed.targetUserId) {
+          config.headers['X-Impersonate-User'] = parsed.targetUserId
+        }
+      }
+      catch {
+        // Invalid data — ignore
+      }
+    }
+
     if (import.meta.env.DEV) {
       console.log(`🚀 ${config.method?.toUpperCase()} ${config.url}`, config.data)
     }
@@ -46,6 +61,17 @@ apiClient.interceptors.response.use(
     const status = error.response?.status
     const notificationStore = useNotificationStore()
 
+    // Handle impersonation session expiry
+    if (status === 403 && error.response?.data?.impersonation_ended) {
+      import('@/stores/useImpersonationStore').then(({ useImpersonationStore }) => {
+        const impersonationStore = useImpersonationStore()
+        impersonationStore.clearState()
+        window.location.href = '/platform'
+      })
+
+      return Promise.reject(error)
+    }
+
     if (status === 401) {
       // Lazy import to avoid circular dependency
       import('@/stores/useAuthStore').then(({ useAuthStore }) => {