Based on your demo site it seems like you need to create an auto action for each user you want to "login as" I hope this is not the case because I do not feel like creating over 15k auto actions.
You don't have to, but yes that's how the demosite is setup. You can have the username, email, or user id login come from a substitution. Example as follows.
Global
Triggers: None
Type: Login / Logout
User: Self
Access: Super Users
Conditions
Field: Custom > Value
Custom Value: [get_loginas]
Operator: Not Empty
Action
Mode: Login
Method: User ID
User ID: [get_loginas]
Force Login: Yes
Redirect: index.php
Now save the auto action. Next under Global you'll have a URL to directly run the auto action. Add &loginas=USER_ID_HERE to the URL and navigate to it to login as that user id. You need to already be logged in as a super user first though.
We don't have backend accessed auto actions. They're all accessed via frontend so it will need some sort of access protections. Whether you do that as an access check done above or you check against a specific token in conditions is up to you. A token check would avoid needing to be logged in on frontend already as a super user. A future CB Auto Actions release will have backend only accessible auto actions.
Additionally as for where you'd render access to this (e.g. a button somewhere) is easy enough as long as the location supports substitutions OR has a trigger with the user to be logged in and outputs its trigger results so you can inject a button via CB Auto Actions. There is no such trigger for CB > User Management though.