Don't force password change while admin is impersonating

The mustChangePassword guard redirected an impersonating admin to
/change-password, which sits outside the student layout (no
return-to-admin banner) — a dead end. Skip the guard when impersonating,
and add the stop-impersonate banner to the change-password page as a
fallback.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/(student)/layout.tsx

@@ -11,12 +11,16 @@ export default async function StudentLayout({ children }: { children: React.Reac
   const session = await auth.api.getSession({ headers: await headers() });
   if (!session) redirect("/login");
 
-  // Force password change for auto-provisioned buyers (temp password)
+  const isImpersonating = !!(session.session as { impersonatedBy?: string }).impersonatedBy;
+
+  // Force password change for auto-provisioned buyers (temp password).
+  // Skip while an admin is impersonating — they only view the client's cabinet;
+  // the client sets their own password on a real first login.
   const dbUser = await prisma.user.findUnique({
     where: { id: session.user.id },
     select: { mustChangePassword: true },
   });
-  if (dbUser?.mustChangePassword) redirect("/change-password");
+  if (dbUser?.mustChangePassword && !isImpersonating) redirect("/change-password");
 
   // Maintenance mode: non-admin users see the maintenance page
   if (session.user.role !== "admin") {
@@ -35,8 +39,6 @@ export default async function StudentLayout({ children }: { children: React.Reac
       getSetting("orgRequisites"),
     ]);
 
-  const isImpersonating = !!(session.session as { impersonatedBy?: string }).impersonatedBy;
-
   return (
     <div className="min-h-screen flex flex-col" style={{ backgroundColor: "var(--background)" }}>
       {isImpersonating && <StopImpersonateBanner userName={session.user.name} />}