fix: skip session tracking and use short-lived token for impersonation (CW-7169) (#14622)

## Description

SuperAdmin impersonation SSO logins no longer create UserSession rows
visible to the customer. Impersonation tokens use a 2-day lifespan
instead of ~2 months, so they naturally evict first and don't linger in
the user's token list.

Server-side detection via Redis value (`'impersonation'` vs `'normal'`)
without changing the `valid_sso_auth_token?` signature. Backward
compatible with in-flight tokens.

Depends on #14556.

## Type of change

- [x] Bug fix (non-breaking change which fixes an issue)

## How Has This Been Tested?

Specs cover: impersonation login skips UserSession creation,
impersonation token has short lifespan, normal SSO login still creates
UserSession row.

## Checklist:

- [x] My code follows the style guidelines of this project
- [x] I have performed a self-review of my code
- [x] I have added tests that prove my fix is effective or that my
feature works
- [x] New and existing unit tests pass locally with my changes
- [x] Any dependent changes have been merged and published in downstream
modules

app/models/concerns/sso_authenticatable.rb

@@ -1,9 +1,9 @@
 module SsoAuthenticatable
   extend ActiveSupport::Concern
 
-  def generate_sso_auth_token
+  def generate_sso_auth_token(impersonation: false)
     token = SecureRandom.hex(32)
-    ::Redis::Alfred.setex(sso_token_key(token), true, 5.minutes)
+    ::Redis::Alfred.setex(sso_token_key(token), impersonation ? 'impersonation' : 'normal', 5.minutes)
     token
   end
 
@@ -20,8 +20,14 @@ module SsoAuthenticatable
     "#{ENV.fetch('FRONTEND_URL', nil)}/app/login?email=#{encoded_email}&sso_auth_token=#{generate_sso_auth_token}"
   end
 
+  def sso_auth_token_impersonation?(token)
+    ::Redis::Alfred.get(sso_token_key(token)) == 'impersonation'
+  end
+
   def generate_sso_link_with_impersonation
-    "#{generate_sso_link}&impersonation=true"
+    encoded_email = ERB::Util.url_encode(email)
+    "#{ENV.fetch('FRONTEND_URL',
+                 nil)}/app/login?email=#{encoded_email}&sso_auth_token=#{generate_sso_auth_token(impersonation: true)}&impersonation=true"
   end
 
   private