Role isolation, impersonation, account ownership, loading spinners, Docker fixes

- Enforce portal role isolation: admin/reseller/user can only auth on their own port
- Admin/reseller impersonation: Login As with cookie handoff + Return banner in user panel
- Account ownership: admin can reassign accounts to resellers, DNS NS follows
- accounts/update: ownership change cascades package + NS to new owner
- users.php endpoint: admin list/filter by role (reseller dropdown)
- Docker launch fix: uDockerUpdateParams defined before call
- Nova.loading() spinners: login, SSL, PHP switch/save, backup create, docker launch/actions
- Logo consistency: gradient CPX text on all login pages, novacpx_logo_html() in all sidebars
- BackupManager: fix DB class name, table name, column name
- DNSManager: fix settings keys (ns1_hostname/ns2_hostname)
- docker.php: resolve account_id from user uid for all actions
- Auth: impersonate sets cookie + stores return_token for seamless round-trip

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

panel/lib/DNSManager.php

@@ -10,8 +10,8 @@ class DNSManager {
     public static function createZone(int $accountId, string $domain): void {
         $db     = DB::getInstance();
         $serial = (int)date('Ymd') * 100 + 1;
-        $ns1    = self::getSetting('default_nameserver1', 'ns1.localhost');
-        $ns2    = self::getSetting('default_nameserver2', 'ns2.localhost');
+        $ns1    = self::getSetting('ns1_hostname', 'ns1.localhost');
+        $ns2    = self::getSetting('ns2_hostname', 'ns2.localhost');
         $email  = 'hostmaster.' . $domain;
         $ip     = self::serverIp();