feat: impersonation system, semi-finalist detail page, tRPC resilience

- Add super-admin impersonation: "Login As" from user list, red banner
  with "Return to Admin", audit logged start/end, nested impersonation
  blocked, onboarding gate skipped during impersonation
- Fix semi-finalist stats: check latest terminal state (not any PASSED),
  use passwordHash OR status=ACTIVE for activation check
- Add /admin/semi-finalists detail page with search, category/status filters
- Add account_reminder_days setting to notifications tab
- Add tRPC resilience: retry on 503/HTML responses, custom fetch detects
  nginx error pages, exponential backoff (2s/4s/8s)
- Reduce dashboard polling intervals (60s stats, 30s activity, 120s semi)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/server/routers/settings.ts

@@ -42,7 +42,7 @@ export const settingsRouter = router({
    * These are non-sensitive settings that can be exposed to any user
    */
   getFeatureFlags: protectedProcedure.query(async ({ ctx }) => {
-    const [whatsappEnabled, juryCompareEnabled, learningHubExternal, learningHubExternalUrl, supportEmail] = await Promise.all([
+    const [whatsappEnabled, juryCompareEnabled, learningHubExternal, learningHubExternalUrl, supportEmail, accountReminderDays] = await Promise.all([
       ctx.prisma.systemSettings.findUnique({
         where: { key: 'whatsapp_enabled' },
       }),
@@ -58,6 +58,9 @@ export const settingsRouter = router({
       ctx.prisma.systemSettings.findUnique({
         where: { key: 'support_email' },
       }),
+      ctx.prisma.systemSettings.findUnique({
+        where: { key: 'account_reminder_days' },
+      }),
     ])
 
     return {
@@ -66,6 +69,7 @@ export const settingsRouter = router({
       learningHubExternal: learningHubExternal?.value === 'true',
       learningHubExternalUrl: learningHubExternalUrl?.value || '',
       supportEmail: supportEmail?.value || '',
+      accountReminderDays: parseInt(accountReminderDays?.value || '3', 10),
     }
   }),