Администратор открывает любой ящик: MAILBOXES → OPEN, полоса «вернуться в admin@»

POST /api/admin/mailboxes/{id}/open — сессия этого ящика без его пароля, только для
MAIL_ADMINS; каждое открытие — в лог (кто какой ящик открыл). В веб-почте: кнопка OPEN
у ящика, сверху розовая полоса «Вы в ящике X как администратор — Back to admin@».
Тесты: +1 (всего 75), ng build OK.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/src/main/java/com/mailserver/controller/MailboxAdminController.java

@@ -3,8 +3,10 @@ package com.mailserver.controller;
 import com.mailserver.config.MailAdmins;
 import com.mailserver.config.MailDomains;
 import com.mailserver.domain.User;
+import com.mailserver.dto.LoginResponse;
 import com.mailserver.service.MailService;
 import com.mailserver.service.UserService;
+import com.mailserver.util.JwtUtils;
 import jakarta.validation.constraints.NotBlank;
 import jakarta.validation.constraints.Size;
 import org.slf4j.Logger;
@@ -66,8 +68,10 @@ public class MailboxAdminController {
     private final MailService mail;
     private final MailDomains domains;
     private final MailAdmins admins;
+    private final JwtUtils jwt;
 
-    public MailboxAdminController(UserService users, MailService mail, MailDomains domains, MailAdmins admins) {
+    public MailboxAdminController(UserService users, MailService mail, MailDomains domains, MailAdmins admins, JwtUtils jwt) {
+        this.jwt = jwt;
         this.users = users;
         this.mail = mail;
         this.domains = domains;
@@ -123,6 +127,21 @@ public class MailboxAdminController {
         });
     }
 
+    /**
+     * Administrator opens a mailbox without its password (Settings → MAILBOXES → Open): a session of that mailbox.
+     * Every opening is logged — who opened which mailbox.
+     */
+    @PostMapping("/{id}/open")
+    public Mono<LoginResponse> open(Mono<Authentication> auth, @PathVariable Long id) {
+        return admin(auth).flatMap(me -> mailbox(id).map(user -> {
+            log.warn("Administrator {} opened mailbox {}", me, user.getEmail());
+            LoginResponse response = new LoginResponse();
+            response.setToken(jwt.generateToken(user.getEmail()));
+            response.setEmail(user.getEmail());
+            return response;
+        }));
+    }
+
     /** Switched off: no login (web, SMTP, IMAP); mail to it is still received. */
     @PutMapping("/{id}/active")
     public Mono<MailboxView> active(Mono<Authentication> auth, @PathVariable Long id, @RequestBody Mono<ActiveRequest> body) {