fix(jira): honor jira_email override in account-id lookup, not just email

lookup_user_jira_account_id() only ever searched by Aegis login email,
ignoring the jira_email override field that exists precisely for users
whose corporate Atlassian email differs from their Aegis login email
(the rest of jira_service.py already documents and uses this priority
order). Found via jesus-huertas, whose real Jira account uses a
different email than his Aegis account.

backend/tests/test_jira_service.py

@@ -427,6 +427,7 @@ def _make_user(**overrides):
     u.username = "gerardo-ruiz"
     u.email = "gerardo.ruiz@kaseya.com"
     u.jira_account_id = None
+    u.jira_email = None
     for k, v in overrides.items():
         setattr(u, k, v)
     return u
@@ -455,6 +456,28 @@ def test_lookup_user_jira_account_id_calls_with_valid_kwargs(mock_get_client, mo
     assert user.jira_account_id == "abc123"
 
 
+@patch("app.services.jira_service.has_admin_jira_configured", return_value=True)
+@patch("app.services.jira_service.get_admin_jira_client")
+def test_lookup_user_jira_account_id_prefers_jira_email_override(mock_get_client, mock_configured, db):
+    """Regression: a user's real Atlassian email can differ from their Aegis
+    login email (e.g. jesus-huertas@kaseya.com in Aegis vs
+    jesus.rodenas@kaseya.com in Jira) — jira_email must take priority."""
+    mock_jira = MagicMock()
+    mock_jira.user_find_by_user_string.return_value = [
+        {"emailAddress": "jesus.rodenas@kaseya.com", "accountId": "jesus-account-id"}
+    ]
+    mock_get_client.return_value = mock_jira
+    user = _make_user(email="jesus.huertas@kaseya.com", jira_email="jesus.rodenas@kaseya.com")
+
+    updated = jira_service.lookup_user_jira_account_id(db, user)
+
+    mock_jira.user_find_by_user_string.assert_called_once_with(
+        query="jesus.rodenas@kaseya.com", limit=10
+    )
+    assert updated is True
+    assert user.jira_account_id == "jesus-account-id"
+
+
 @patch("app.services.jira_service.has_admin_jira_configured", return_value=True)
 @patch("app.services.jira_service.get_admin_jira_client")
 def test_lookup_user_jira_account_id_no_match(mock_get_client, mock_configured, db):