Don't force password change while admin is impersonating

The mustChangePassword guard redirected an impersonating admin to
/change-password, which sits outside the student layout (no
return-to-admin banner) — a dead end. Skip the guard when impersonating,
and add the stop-impersonate banner to the change-password page as a
fallback.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/change-password/page.tsx

@@ -2,24 +2,30 @@ import { headers } from "next/headers";
 import { auth } from "@/lib/auth";
 import { redirect } from "next/navigation";
 import { ForceChangeForm } from "./force-change-form";
+import { StopImpersonateBanner } from "@/components/admin/stop-impersonate-banner";
 
 export default async function ChangePasswordPage() {
   const session = await auth.api.getSession({ headers: await headers() });
   if (!session) redirect("/login");
 
+  const isImpersonating = !!(session.session as { impersonatedBy?: string }).impersonatedBy;
+
   return (
     <div
-      className="min-h-screen flex items-center justify-center p-4"
+      className="min-h-screen flex flex-col"
       style={{ backgroundColor: "var(--background)" }}
     >
-      <div className="w-full max-w-sm">
-        <h1 className="text-xl font-bold mb-2" style={{ color: "var(--foreground)" }}>
-          Задайте свой пароль
-        </h1>
-        <p className="text-sm mb-6" style={{ color: "var(--muted-foreground)" }}>
-          Вы вошли с временным паролем. Перед началом работы задайте постоянный — это займёт минуту.
-        </p>
-        <ForceChangeForm />
+      {isImpersonating && <StopImpersonateBanner userName={session.user.name} />}
+      <div className="flex-1 flex items-center justify-center p-4">
+        <div className="w-full max-w-sm">
+          <h1 className="text-xl font-bold mb-2" style={{ color: "var(--foreground)" }}>
+            Задайте свой пароль
+          </h1>
+          <p className="text-sm mb-6" style={{ color: "var(--muted-foreground)" }}>
+            Вы вошли с временным паролем. Перед началом работы задайте постоянный — это займёт минуту.
+          </p>
+          <ForceChangeForm />
+        </div>
       </div>
     </div>
   );