fix(tests): pause reopen timer, lock edits to assignee, restore Jira operator on reopen

- reopen_red_review starts the timer paused (paused_at set) instead of
  immediately running, since the operator hasn't resumed working yet —
  blue already did this via blue_work_started_at, red needed the same
  behavior via the existing pause/resume mechanism.
- update_test_red/update_test_blue now lock edits to the actual assigned
  operator for leads too, not just techs — a lead could previously edit
  another operator's in-progress test. Mirrored in TeamTabs.tsx.
- push_test_event reassigns the Jira ticket to the original operator
  (not the reopening lead) when a test returns to red_executing or
  blue_evaluating for rework, instead of leaving it on the lead.

frontend/src/components/test-detail/TeamTabs.tsx

@@ -151,20 +151,29 @@ export default function TeamTabs({
     enabled: !!test.technique_mitre_id,
   });
 
+  // Only the operator actually assigned to this test may edit it — a lead
+  // (or a different tech) is not allowed just because their role normally
+  // could, unless the test hasn't been assigned to anyone yet (e.g. still
+  // being prepped in draft). Mirrors the backend's assignee-lock check.
+  const isRedAssignee = test.red_tech_assignee === null || test.red_tech_assignee === user?.id;
+  const isBlueAssignee = test.blue_tech_assignee === null || test.blue_tech_assignee === user?.id;
+
   // Leads can edit during both draft and executing phases. Operators
   // (red_tech) may only edit once execution has started — the timer must
   // be running before they can document the attack. Admin administers the
   // site, not test content, so it never gets edit rights here.
   const canEditRed =
-    (test.state === "red_executing" &&
+    isRedAssignee &&
+    ((test.state === "red_executing" &&
       (role === "red_tech" || role === "red_lead")) ||
-    (test.state === "draft" && role === "red_lead");
+    (test.state === "draft" && role === "red_lead"));
 
   // Blue operators may only edit after they explicitly pick up the test
   // (Start Evaluation pressed → blue_work_started_at is set).
   // Blue leads can edit at any point during blue_evaluating.
   const canEditBlue =
     BLUE_EDITABLE_STATES.includes(test.state) &&
+    isBlueAssignee &&
     (role === "blue_lead" ||
       (role === "blue_tech" && !!test.blue_work_started_at));