Add audit logging for service impersonation events

[Copilot]

Service impersonation requests were not logged, creating a security audit gap. Services can act as users via X-Impersonate-Id header, but there was no persistent record of these actions.

Changes

• Added Logger to HybridJwtGuard: Logs all impersonation attempts (success and failure) with service name, user UUID, and roles
• Three failure cases tracked: service lacks impersonation permission, user not found, user role restrictions violated
• Privacy-preserving: Logs user UUIDs only, not internal numeric IDs or PII (names, emails)

Example log output:

Service impersonation granted - SMS Bridge: user abc-123-def with roles USER,ADMIN
Service impersonation denied - Payment Gateway: user not found
Service impersonation denied - Notification Service: service not allowed to impersonate

Audit logs follow existing auth service patterns for consistency.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.