Return the impersonation page-shell config.

canExchange mirrors the /exchange gate so the SPA only offers the Impersonate action to callers who could actually complete the exchange: an end-user (not a service token, not an already-impersonating session) holding editor on the dock impersonation module instance. The route itself still requires reader on the impersonation module (router gate); only the editor check used to compute canExchange degrades to false on FGA error so the page shell can render once the caller has passed that module gate.