fix(dashboard): graceful UX when an impersonation grant is revoked mid-session

[iammukeshm]

What

Revoking (or expiring) an in-progress impersonation left the dead impersonation token installed in the dashboard: every request 401d, but the page just rendered a stuck red error band under a half-loaded surface while the "End impersonation" banner lingered — a confusing, broken-looking state.

The dashboard now detects this and routes to a calm full-screen Impersonation ended terminal page that clears the dead token via Back to sign in. Mirrors the existing deactivated-tenant flow.

How

• api-client.ts — new isImpersonationRevokedError(): true on a 401 while the active token carries the act_sub impersonation claim. This is the durable signal — production deliberately blanks the 401 body (the "Impersonation grant revoked or ended" reason is dev-only), and impersonation sessions never hold a refresh token, so such a 401 always propagates to the hook instead of being silently refreshed-and-retried.
• query-client.ts — extended the global query/mutation error hook (alongside the existing tenant-deactivated branch) to route to /impersonation-ended, passing the dev-only reason via router state. Does not clear the token here (would race ProtectedRoute to /login).
• pages/impersonation-ended.tsx — new top-level terminal page mirroring tenant-deactivated.tsx.
• routes.tsx — lazy import + top-level route (outside ProtectedRoute/AppShell).

Tests

• New tests/impersonation/impersonation-ended.spec.ts (2 specs): a 401 on an impersonation session routes to the page; Back to sign in clears the token and lands on /login. Both green.
• tsc -b clean, eslint clean.

Docs

Changelog entry (2026-06-09) added in the separate docs repo.

🤖 Generated with Claude Code