fix: impersonation, dashboard counter, logo lightbox, submission config, auth logs

- Fix impersonation by bypassing useSession().update() loading gate with direct session POST
- Fix dashboard account counter defaulting to latest round with PASSED projects
- Add clickToEnlarge lightbox for project logos on admin detail page
- Remove submission eligibility config (all passed projects must upload)
- Suppress CredentialsSignin auth errors in production (minified name check)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/lib/session-update.ts

@@ -0,0 +1,23 @@
+/**
+ * Direct session update that bypasses useSession().update()'s `if (loading) return;` guard.
+ * This ensures the JWT cookie is always updated, even when another session refresh is in-flight.
+ */
+export async function directSessionUpdate(data: Record<string, unknown>): Promise<boolean> {
+  try {
+    // Get CSRF token
+    const csrfResp = await fetch('/api/auth/csrf')
+    if (!csrfResp.ok) return false
+    const { csrfToken } = await csrfResp.json()
+
+    // POST session update
+    const resp = await fetch('/api/auth/session', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ csrfToken, data }),
+    })
+
+    return resp.ok
+  } catch {
+    return false
+  }
+}