feat: add as, as-group and as-uid as available arguments

[carlottostromstedt]

What

Adds --as, --as-group, and --as-uid to let the whole session run as another Kubernetes identity, matching the equivalent kubectl flags.

For example:

ku --edit --as system:admin --as-group system:masters

This is useful when you need to access objects your normal kubeconfig identity cannot, such as deleting something that requires cluster-admin privileges.

--as-group can be specified multiple times.

How

The flags are turned into a k8s.Impersonation in main.go and passed through clientcmd using the same AuthInfo.Impersonate, ImpersonateGroups, and ImpersonateUID overrides that kubectl uses.

From there, the identity ends up on rest.Config.Impersonate. All clients and transports in internal/k8s are built from that same config, including the clientset, dynamic and discovery clients, exec, port-forward, and WebSocket transports. That means individual call sites don't need to know anything about impersonation.

Impersonation.Validate also catches invalid combinations up front, such as specifying a group or UID without a user. clientcmd would reject these too, but validating them when the session starts gives a more useful error tied directly to the flags the user provided.

The identity is stored on App, so switchContextCmd carries it over when rebuilding the client. It is never persisted to state.json.

Behavior

• A warn-styled as chip appears in the header while impersonation is active. It shows the impersonated user and group count.
• The C command preview includes the impersonation flags, so the generated kubectl command matches the session. --as-group and --as-uid are only shown when --as is present, since kubectl doesn't accept them on their own.
• --check includes an as: line showing the active identity.
• Impersonation survives a context switch with c, because the rebuilt client keeps the same identity.
• Impersonation is only for the current invocation; the next launch uses the normal identity again.
• It changes who you are, not what the session is allowed to do. Edit mode is still read-only unless --edit is passed or Shift+E is pressed.

Testing

Added coverage for:

• internal/k8s/impersonate_test.go: Active, Validate, String, kubeconfig → rest.Config impersonation, and preserving impersonation across context overrides.
• main_test.go: repeatable --as-group, empty groups, and flag validation.
• internal/ui/impersonate_test.go: chip rendering, chip labels, context switches, and chip overflow.
• internal/ui/command_view_test.go: impersonation flags in generated commands, omission when unset, and requiring --as.
• internal/ui/help_view_test.go: wrapping the mode note without widening the modal.

make test and make vet both pass.