fix(users): add manager to the valid-role whitelist

'manager' has been a fully-functional role throughout the app —
notifications, operator assignment, dispute mediation — but was
missing from both the user creation/update whitelist and the SSO
auto-provisioning role list, so a manager account could never
actually be created.

backend/app/services/sso_service.py

@@ -202,7 +202,7 @@ def process_callback(db: Session, request_data: dict) -> User:
     )
 
     # Validate role
-    valid_roles = {"admin", "red_lead", "blue_lead", "red_tech", "blue_tech", "viewer"}
+    valid_roles = {"admin", "red_lead", "blue_lead", "red_tech", "blue_tech", "manager", "viewer"}
     if role not in valid_roles:
         log.warning("SSO: unknown role '%s' for user '%s', falling back to default", role, username)
         role = cfg.default_role or "viewer"

backend/app/services/user_service.py

@@ -26,8 +26,8 @@ from app.domain.errors import (
 # Import User from app.models.user
 from app.models.user import User
 
-# Assign VALID_ROLES = {"admin", "red_tech", "blue_tech", "red_lead", "blue_lead", "viewer"}
-VALID_ROLES = {"admin", "red_tech", "blue_tech", "red_lead", "blue_lead", "viewer"}
+# Assign VALID_ROLES = {"admin", "red_tech", "blue_tech", "red_lead", "blue_lead", "manager", "viewer"}
+VALID_ROLES = {"admin", "red_tech", "blue_tech", "red_lead", "blue_lead", "manager", "viewer"}
 
 
 # Define function list_users

backend/tests/test_user_api_validation.py

@@ -57,3 +57,35 @@ def test_create_user_valid_password_accepted(client, admin_user, admin_token):
     )
     assert response.status_code == 201
     assert response.json()["username"] == "validuser99"
+
+
+def test_create_user_with_manager_role_accepted(client, admin_user, admin_token):
+    """Regression: 'manager' is a real, actively-used role (dispute mediation,
+    operator assignment) but was missing from the creation whitelist."""
+    response = client.post(
+        "/api/v1/users",
+        json={
+            "username": "newmanager",
+            "password": "ValidPass123!@#",
+            "email": "newmanager@test.com",
+            "role": "manager",
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    assert response.status_code == 201, response.text
+    assert response.json()["role"] == "manager"
+
+
+def test_create_user_invalid_role_rejected(client, admin_user, admin_token):
+    response = client.post(
+        "/api/v1/users",
+        json={
+            "username": "badroleuser",
+            "password": "ValidPass123!@#",
+            "email": "badrole@test.com",
+            "role": "superuser",
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    assert response.status_code == 400
+    assert "Invalid role" in response.text