Superadmin impersonation, hardened auth/upload paths, dependency updates

- Add superadmin impersonation: sessions.impersonated_by (migration 0003) is
  stamped onto audit rows so impersonated actions are attributable, with a
  persistent ImpersonationBanner in the app shell.
- Harden auth and upload handling across routes (safe redirect targets,
  filename sanitization, checkout grant handling).
- Update dependencies: Sentry 8 -> 10, @fastify/static 8 -> 10,
  react-router-dom 6.30.6; add find-my-way / fast-uri overrides.
- Add tests for safe-next, checkout-grant, and upload-filename.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -29,3 +29,16 @@ jobs:
 
       - name: Build web
         run: npm run build
+
+      # Gate: any HIGH/CRITICAL advisory in a dependency that actually ships to production fails
+      # the build. Scoped with --omit=dev on purpose — the dev-only toolchain (vite, esbuild,
+      # drizzle-kit) carries advisories that only affect a developer's local dev server, and
+      # blocking every PR on those trains people to ignore the gate.
+      - name: Audit production dependencies
+        run: npm audit --omit=dev --audit-level=high
+
+      # Full picture, including dev tooling. Never blocks — it's here so regressions are visible
+      # in the log and someone can act on them deliberately.
+      - name: Audit report (informational, includes dev)
+        if: always()
+        run: npm audit || true