Superadmin impersonation, hardened auth/upload paths, dependency updates

- Add superadmin impersonation: sessions.impersonated_by (migration 0003) is
  stamped onto audit rows so impersonated actions are attributable, with a
  persistent ImpersonationBanner in the app shell.
- Harden auth and upload handling across routes (safe redirect targets,
  filename sanitization, checkout grant handling).
- Update dependencies: Sentry 8 -> 10, @fastify/static 8 -> 10,
  react-router-dom 6.30.6; add find-my-way / fast-uri overrides.
- Add tests for safe-next, checkout-grant, and upload-filename.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/db/migrations/0003_illegal_leper_queen.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "sessions" ADD COLUMN "impersonated_by" uuid;--> statement-breakpoint
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_impersonated_by_users_id_fk" FOREIGN KEY ("impersonated_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;

packages/db/migrations/meta/_journal.json

@@ -22,6 +22,13 @@
       "when": 1784308478719,
       "tag": "0002_daily_chronomancer",
       "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "7",
+      "when": 1787753919185,
+      "tag": "0003_illegal_leper_queen",
+      "breakpoints": true
     }
   ]
 }

packages/db/src/schema/auth.ts

@@ -40,6 +40,10 @@ export const sessions = pgTable(
       .notNull()
       .references(() => users.id, { onDelete: 'cascade' }),
     expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+    // Set when a superadmin opened this session via /api/admin/users/:id/impersonate. Non-null
+    // means every action on this session is really that admin acting as `userId` — the API
+    // stamps it onto audit rows and the UI shows a persistent impersonation banner.
+    impersonatedBy: uuid('impersonated_by').references(() => users.id, { onDelete: 'set null' }),
     ip: inet('ip'),
     userAgent: text('user_agent'),
     lastSeenAt: timestamp('last_seen_at', { withTimezone: true }).notNull().defaultNow(),