fix: impersonation navigation uses full page reload

Replace router.push() with window.location.href for both
start and end impersonation to ensure the updated JWT cookie
is sent with the new request. Client-side routing can race
with cookie propagation, causing the server to see the old
session and redirect back to admin.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/components/admin/user-actions.tsx

@@ -126,9 +126,9 @@ export function UserActions({ userId, userEmail, userStatus, userRole, userRoles
     try {
       const result = await startImpersonation.mutateAsync({ targetUserId: userId })
       await update({ impersonate: userId })
-      toast.success(`Now impersonating ${userEmail}`)
-      router.push(getRoleHomePath(result.targetRole) as Route)
-      router.refresh()
+      // Full page navigation to ensure the updated JWT cookie is sent
+      // (router.push can race with cookie propagation)
+      window.location.href = getRoleHomePath(result.targetRole)
     } catch (error) {
       toast.error(error instanceof Error ? error.message : 'Failed to start impersonation')
     }
@@ -302,9 +302,7 @@ export function UserMobileActions({
     try {
       const result = await startImpersonation.mutateAsync({ targetUserId: userId })
       await update({ impersonate: userId })
-      toast.success(`Now impersonating ${userEmail}`)
-      router.push(getRoleHomePath(result.targetRole) as Route)
-      router.refresh()
+      window.location.href = getRoleHomePath(result.targetRole)
     } catch (error) {
       toast.error(error instanceof Error ? error.message : 'Failed to start impersonation')
     }

src/components/shared/impersonation-banner.tsx

@@ -18,9 +18,8 @@ export function ImpersonationBanner() {
     try {
       await endImpersonation.mutateAsync()
       await update({ endImpersonation: true })
-      toast.success('Returned to admin account')
-      router.push('/admin/members')
-      router.refresh()
+      // Full page navigation to ensure updated JWT cookie is sent
+      window.location.href = '/admin/members'
     } catch (error) {
       toast.error(error instanceof Error ? error.message : 'Failed to end impersonation')
     }