fix(users): grant manager Review Queue access, restrict Webhooks to admin

Manager could not see the Review Queue nav item, load the page, or
call mark-reviewed (red_lead/blue_lead/admin only) — added to the
route guard, sidebar visibility, badge query, and the backend
endpoint's role check.

Webhook Configuration was shown to red_lead/blue_lead in Settings
even though the backend already restricted every webhook endpoint to
admin only — the tab is now admin-only in the UI too, matching what
was already enforced server-side.

backend/tests/test_review_queue_manager_access.py

@@ -0,0 +1,25 @@
+"""Manager must have the same Review Queue access as red_lead/blue_lead —
+mark_reviewed was previously red_lead/blue_lead (and admin) only."""
+
+
+def test_manager_can_mark_technique_reviewed(client, db, api, auth_headers, manager_headers):
+    resp = api(
+        "post", "/api/v1/techniques", auth_headers,
+        json={"mitre_id": "T1059.400", "name": "Manager Review Access Technique"},
+    )
+    assert resp.status_code == 201, resp.text
+
+    resp = api("patch", "/api/v1/techniques/T1059.400/review", manager_headers)
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["review_required"] is False
+
+
+def test_red_tech_cannot_mark_technique_reviewed(client, db, api, auth_headers, red_tech_headers):
+    resp = api(
+        "post", "/api/v1/techniques", auth_headers,
+        json={"mitre_id": "T1059.401", "name": "Red Tech No Access Technique"},
+    )
+    assert resp.status_code == 201, resp.text
+
+    resp = api("patch", "/api/v1/techniques/T1059.401/review", red_tech_headers)
+    assert resp.status_code == 403