Login to client account programatically

Then I would extend the method you use that checks from which domain a request is coming.

Set CI up that test.example.com === example.com/test.example.com when you have a valid login session

There is no need for you too literally access the clients site via the subdomain. You just need to make CI think you are accessing it via that subdomain. And of course make sure only you as the super admin can do this form the main domain