Impersonation flow (super_admin)

[tayebmokni]

Summary

Implement super-admin impersonation per the session blob's impersonator_user_id field (doc 06 §5.1). A super_admin can start an impersonation session against another user; the session blob carries both the impersonated user_id and the original impersonator_user_id. The audit log captures both. Impersonation is loud: the admin shell shows a persistent banner "You are impersonating — Stop impersonating", every audit event is double-tagged, and certain destructive actions (delete user, change roles for super_admins) are blocked while impersonating. Stop returns to the original session.

Design reference

• docs/06-auth-permissions.md §5.1 (Sessions — impersonator_user_id)

Acceptance criteria

• POST /api/v1/admin/impersonate/{user_id} (capability super_admin-only) creates a new session blob with impersonator_user_id = current_user_id, user_id = target_user_id
• POST /api/v1/admin/impersonate/stop restores the original session
• Banner in admin shell when impersonator_user_id != null
• Audit log entries auth.impersonate.start and auth.impersonate.stop with both actor and target
• Every audit event during impersonation includes the impersonator alongside the actor
• Destructive actions blocked while impersonating: deleting other super_admins, demoting other super_admins
• Cannot impersonate another super_admin
• Cannot nest impersonations

Dependencies

Depends on Session store, Roles + capabilities + policy package, Audit log.

Complexity

M

[tayebmokni]

Closing — shipped in the final-wave PR (#487-#492). Auto-close only fires for first ref.