feat(tempo): harden worklog sync and add tests [FASE-1.4]

Add tempo-api-python-client dependency, TEMPO_API_VERSION setting, enum-safe Jira link lookup, work type on create_worklog, and mocked auto_log tests.

backend/tests/test_tempo_service.py

@@ -0,0 +1,60 @@
+"""Tempo service unit tests (FASE-1.4)."""
+
+from datetime import datetime
+from unittest.mock import MagicMock, patch
+from uuid import uuid4
+
+import pytest
+
+from app.domain.exceptions import InvalidOperationError
+from app.models.jira_link import JiraLink, JiraLinkEntityType
+from app.services import tempo_service
+
+
+def test_auto_log_test_worklog_skips_when_disabled(monkeypatch, db):
+    monkeypatch.setattr("app.services.tempo_service.settings.TEMPO_ENABLED", False)
+    test = MagicMock()
+    test.id = uuid4()
+    user = MagicMock()
+    assert tempo_service.auto_log_test_worklog(db, test, user, "red_team_execution") is None
+
+
+def test_get_tempo_client_raises_when_disabled(monkeypatch):
+    monkeypatch.setattr("app.services.tempo_service.settings.TEMPO_ENABLED", False)
+    with pytest.raises(InvalidOperationError, match="not enabled"):
+        tempo_service.get_tempo_client()
+
+
+@patch("app.services.tempo_service.log_worklog")
+def test_auto_log_test_worklog_calls_tempo(mock_log_worklog, monkeypatch, db, admin_user):
+    monkeypatch.setattr("app.services.tempo_service.settings.TEMPO_ENABLED", True)
+    mock_log_worklog.return_value = {"id": "wl-1"}
+
+    test_id = uuid4()
+    link = JiraLink(
+        entity_type=JiraLinkEntityType.test,
+        entity_id=test_id,
+        jira_issue_key="TST-10",
+        jira_issue_id="10010",
+        created_by=admin_user.id,
+    )
+    db.add(link)
+    db.commit()
+
+    test = MagicMock()
+    test.id = test_id
+    test.name = "Phishing simulation"
+    test.red_started_at = datetime(2026, 5, 18, 10, 0, 0)
+    test.updated_at = datetime(2026, 5, 18, 12, 0, 0)
+    test.created_at = test.updated_at
+
+    result = tempo_service.auto_log_test_worklog(
+        db, test, admin_user, "red_team_execution",
+    )
+
+    assert result == {"id": "wl-1"}
+    mock_log_worklog.assert_called_once()
+    kwargs = mock_log_worklog.call_args.kwargs
+    assert kwargs["jira_issue_id"] == 10010
+    assert kwargs["time_spent_seconds"] > 0
+    assert "[Aegis]" in kwargs["description"]