fix(tests): pause reopen timer, lock edits to assignee, restore Jira operator on reopen

- reopen_red_review starts the timer paused (paused_at set) instead of
  immediately running, since the operator hasn't resumed working yet —
  blue already did this via blue_work_started_at, red needed the same
  behavior via the existing pause/resume mechanism.
- update_test_red/update_test_blue now lock edits to the actual assigned
  operator for leads too, not just techs — a lead could previously edit
  another operator's in-progress test. Mirrored in TeamTabs.tsx.
- push_test_event reassigns the Jira ticket to the original operator
  (not the reopening lead) when a test returns to red_executing or
  blue_evaluating for rework, instead of leaving it on the lead.

backend/tests/test_test_edit_assignee_lock.py

@@ -0,0 +1,117 @@
+"""Only the operator actually assigned to a test may edit its fields —
+not just any red_tech/blue_tech, and not the lead either, unless the lead
+is themselves the assignee. Reproduces the bug report: a red_lead could
+edit a test assigned to a different operator (jesus-huertas)."""
+
+from app.models.enums import TestState
+from app.models.test import Test
+from app.models.technique import Technique
+
+
+def _seed_technique(db) -> Technique:
+    technique = Technique(
+        mitre_id="T9998",
+        name="Assignee Lock Test Technique",
+        tactic="execution",
+        platforms=["linux"],
+    )
+    db.add(technique)
+    db.commit()
+    db.refresh(technique)
+    return technique
+
+
+def _seed_test(db, technique, created_by, **overrides) -> Test:
+    test = Test(technique_id=technique.id, name="Locked test", created_by=created_by, **overrides)
+    db.add(test)
+    db.commit()
+    db.refresh(test)
+    return test
+
+
+def test_red_lead_cannot_edit_test_assigned_to_other_operator(
+    client, db, red_lead_headers, red_lead_user, red_tech_user
+):
+    technique = _seed_technique(db)
+    test = _seed_test(
+        db, technique, red_lead_user.id,
+        state=TestState.red_executing, red_tech_assignee=red_tech_user.id,
+    )
+
+    resp = client.patch(
+        f"/api/v1/tests/{test.id}/red",
+        json={"procedure_text": "changed by the wrong lead"},
+        headers=red_lead_headers,
+    )
+    assert resp.status_code == 403
+    assert "assigned to another operator" in resp.json()["detail"]
+
+
+def test_different_red_tech_cannot_edit_test_assigned_to_other_operator(
+    client, db, red_lead_headers, red_lead_user, red_tech_user, red_tech_headers
+):
+    technique = _seed_technique(db)
+    # Assigned to red_lead_user (leads can be operators too via /assign) so
+    # a *different* red_tech is the one locked out here.
+    test = _seed_test(
+        db, technique, red_lead_user.id,
+        state=TestState.red_executing, red_tech_assignee=red_lead_user.id,
+    )
+
+    resp = client.patch(
+        f"/api/v1/tests/{test.id}/red",
+        json={"procedure_text": "changed by a different tech"},
+        headers=red_tech_headers,
+    )
+    assert resp.status_code == 403
+
+
+def test_assigned_red_tech_can_edit_own_test(
+    client, db, red_tech_headers, red_tech_user, red_lead_user
+):
+    technique = _seed_technique(db)
+    test = _seed_test(
+        db, technique, red_lead_user.id,
+        state=TestState.red_executing, red_tech_assignee=red_tech_user.id,
+    )
+
+    resp = client.patch(
+        f"/api/v1/tests/{test.id}/red",
+        json={"procedure_text": "changed by the assigned operator"},
+        headers=red_tech_headers,
+    )
+    assert resp.status_code == 200, resp.text
+
+
+def test_blue_lead_cannot_edit_test_assigned_to_other_operator(
+    client, db, blue_lead_headers, blue_lead_user, blue_tech_user
+):
+    technique = _seed_technique(db)
+    test = _seed_test(
+        db, technique, blue_lead_user.id,
+        state=TestState.blue_evaluating, blue_tech_assignee=blue_tech_user.id,
+    )
+
+    resp = client.patch(
+        f"/api/v1/tests/{test.id}/blue",
+        json={"detection_result": "detected"},
+        headers=blue_lead_headers,
+    )
+    assert resp.status_code == 403
+    assert "assigned to another operator" in resp.json()["detail"]
+
+
+def test_unassigned_test_is_editable_by_any_eligible_role(
+    client, db, red_lead_headers, red_lead_user
+):
+    """No assignee yet (e.g. still in draft/newly executing) — the lock
+    only kicks in once an operator has actually been assigned."""
+    technique = _seed_technique(db)
+    test = _seed_test(db, technique, red_lead_user.id, state=TestState.red_executing)
+
+    resp = client.patch(
+        f"/api/v1/tests/{test.id}/red",
+        json={"procedure_text": "no assignee set yet"},
+        headers=red_lead_headers,
+    )
+    assert resp.status_code == 200, resp.text