sign in as a user, from user management

the support case this exists for is "it does not work for them and it does for
me". reproducing that with a password reset means locking somebody out of their
own account in order to look at it, which is worse than the bug.

THE TOKEN SAYS WHO IS REALLY HOLDING IT. `impersonatedBy` rides on the claim and
reaches every handler, because user-middleware puts the whole payload on the
context. without it an impersonated action is indistinguishable from that
person's own — in a log, in a transcript, in anything keyed on a user id — and a
support tool that can forge activity as somebody else is a different and much
worse thing than a support tool.

ONE HOUR, not thirty days. a session lasts a month because a person uses their
own account daily; impersonation is a task you finish. an hour is long enough to
reproduce a problem and short enough that a forgotten tab stops being a live
credential for somebody else's account by lunchtime.

IT CANNOT CHAIN, and that is the guard that matters. `ownerGate` refuses any
token carrying `impersonatedBy`, so impersonating another Super Admin does NOT
hand user management back — which would have made this a way to launder owner
actions through somebody else's id. stated twice, in the gate and in the handler,
because one file away is too far for this one.

THE WAY BACK IS A STASHED TOKEN, not a route. nothing on the server mints an
owner session — a far more dangerous thing to own than this whole feature. the
cost is that clearing browser storage strands you as the other person until the
hour expires, and signing in again fixes that.

the banner is loud and sits ABOVE the header, outside everything a fullscreen
panel can hide. the failure it prevents is not a hole, it is forgetting: reading
a mailbox or deleting something while believing it is yours. it asks the server
who it is rather than decoding the token, so it cannot keep showing a name after
the hour has run out.

verified end to end against a throwaway account, since this host has one user:
impersonate 200 with the target's id and impersonatedBy naming the owner, 60
minute lifetime, /auth/me answering as them; self 400, unknown user 404, chaining
403, user management while impersonating 403; one [SECURITY] line per start. the
probe account was deleted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

src/apps/officer-web/Screens/Dashboard/Layout/DashboardLayout.tsx

@@ -1,6 +1,6 @@
 import { useMemo, useRef } from 'react';
 import { useLocation } from 'react-router';
-import { useDock, usePanelFullscreen, useChatNotifications } from 'officerdev';
+import { ImpersonationBanner, useDock, usePanelFullscreen, useChatNotifications } from 'officerdev';
 import { usePermissions } from 'hooks/usePermissions';
 import { ErrorBoundary } from '@/components/ErrorBoundary';
 import { ScreenErrorFallback } from './ScreenErrorFallback';
@@ -46,6 +46,9 @@ export function DashboardLayout({ children }: DashboardLayoutProps) {
 
   return (
     <div className="relative flex h-dvh flex-col overflow-hidden outline-none inset-0">
+      {/* ABOVE the header, and outside everything that can be hidden. A fullscreen panel hides the header;
+          it must not be able to hide the fact that you are somebody else. Renders nothing when you are not. */}
+      <ImpersonationBanner />
       <Header dockItems={visibleItems} hidden={panelFullscreen} />
       {/* Outside the content region on purpose, like the header and the dock: whatever a screen is doing
           — maximised panel, error boundary, mid-navigation — ctrl-space still gets you off it. */}

src/apps/officer-web/Screens/Dashboard/Settings/UserManagement/UsersSection.tsx

@@ -1,7 +1,17 @@
+import { startImpersonation } from 'officerdev';
 import { useState } from 'react';
 import { useQuery, useQueryClient } from '@tanstack/react-query';
 import { toast } from 'sonner';
-import { Crown, Trash2, Loader2, KeyRound, RotateCcw, Copy, SquareTerminal as TerminalIcon } from 'lucide-react';
+import {
+  Copy,
+  Crown,
+  KeyRound,
+  Loader2,
+  RotateCcw,
+  SquareTerminal as TerminalIcon,
+  Trash2,
+  UserCog,
+} from 'lucide-react';
 import { useClient } from 'hooks/useClient';
 import { Button } from '@/components/ui/button';
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
@@ -128,6 +138,25 @@ export const UsersSection = () => {
     }
   };
 
+  /**
+   * Sign in as this person, for an hour.
+   *
+   * No confirmation dialog, deliberately: it is reversible from the banner in one click, it destroys
+   * nothing, and it is a support action taken while somebody is waiting. The dialogs beside it guard a
+   * new password and a deletion, which are neither.
+   */
+  const impersonate = async (user: ManagedUser) => {
+    setPendingId(user.id);
+    try {
+      const { token } = await client.post<{ token: string }>(`/users/${user.id}/impersonate`, {});
+      // Swaps the token and reloads — nothing after this line runs.
+      startImpersonation(token);
+    } catch (ex) {
+      toast.error(ex instanceof Error ? ex.message : 'Could not sign in as that user');
+      setPendingId(null);
+    }
+  };
+
   const remove = async (user: ManagedUser) => {
     setPendingId(user.id);
     setConfirmDelete(null);
@@ -263,6 +292,22 @@ export const UsersSection = () => {
                 </Button>
               )}
 
+              {/* Not for the owner: impersonating yourself is refused by the route, and the row that
+                  offers it would be the one row where it cannot work. */}
+              {!user.isOwner && (
+                <Button
+                  variant="ghost"
+                  size="icon"
+                  className="shrink-0 text-muted-foreground"
+                  disabled={busy}
+                  aria-label={`Sign in as ${user.email}`}
+                  title="Sign in as this user for one hour"
+                  onClick={() => void impersonate(user)}
+                >
+                  {busy ? <Loader2 className="h-4 w-4 animate-spin" /> : <UserCog className="h-4 w-4" />}
+                </Button>
+              )}
+
               <Button
                 variant="ghost"
                 size="icon"