fix(webapp): take the impersonate route out of the admin layout

The admin layout gates on requireSuper via getUserId, which resolves to the
impersonated user while impersonating — so starting on a second target ran that
gate against the target and it answered with its own redirect to /. The switch
worked only because the router prefers the deepest redirect, which is too subtle
a thing for an auth path to depend on.

The trailing underscore keeps the route at /admin/impersonate while opting it out
of the layout. Nothing is lost: the route only ever redirects, so it never
rendered inside it.

Author: isshaddad

…/webapp/app/routes/admin.impersonate.tsx …webapp/app/routes/admin_.impersonate.tsxapps/webapp/app/routes/admin.impersonate.tsx renamed to apps/webapp/app/routes/admin_.impersonate.tsx apps/webapp/app/routes/admin.impersonate.tsx renamed to apps/webapp/app/routes/admin_.impersonate.tsx

@@ -11,6 +11,18 @@ import { validateAndConsumeImpersonationToken } from "~/services/impersonation.s
 import { logger } from "~/services/logger.server";
 import { sanitizeRedirectPath } from "~/utils";
 
+/**
+ * Served at `/admin/impersonate`, but the trailing `_` on `admin_` keeps it out of the `admin.tsx`
+ * layout on purpose.
+ *
+ * That layout's loader is `dashboardLoader({ authorization: { requireSuper: true } })`, which
+ * resolves the user through `getUserId` — the impersonated id while impersonating. So starting on a
+ * second target ran the parent gate against the target, which isn't a super admin, and it answered
+ * with its own `redirect("/")`. Nesting would leave this route's behaviour depending on the router
+ * preferring the deepest redirect; opting out removes the question. Nothing is lost — this route
+ * only ever redirects, so it never rendered inside the layout anyway.
+ */
+
 const FormSchema = z.object({ id: z.string() });
 
 /**