feat(jira): admin account replaces per-user tokens for all Jira/Tempo ops

- Single admin Jira account stored in system_configs (jira.admin_email, jira.admin_api_token)
- Admin Tempo token in system_configs (tempo.admin_token)
- get_admin_jira_client() + has_admin_jira_configured() replace per-user auth in all lifecycle hooks
- lookup_user_jira_account_id() auto-discovers each user's Atlassian accountId by email on login
- auto_log_test_worklog() now uses admin Tempo token and logs both red+blue team time
- Settings > Jira: admin credentials fields + test buttons moved to admin Jira tab
- Profile section simplified: jira_account_id shown read-only (auto-detected)

frontend/src/api/settings.ts

@@ -163,6 +163,8 @@ export interface JiraConfigOut {
   project_key: string;
   parent_ticket: string;
   parent_ticket_standalone: string;
+  admin_email_set: boolean;
+  tempo_admin_token_set: boolean;
 }
 
 export interface JiraConfigUpdate {
@@ -171,6 +173,9 @@ export interface JiraConfigUpdate {
   project_key?: string;
   parent_ticket?: string;
   parent_ticket_standalone?: string;
+  admin_email?: string;
+  admin_api_token?: string;
+  tempo_admin_token?: string;
 }
 
 export async function getJiraConfig(): Promise<JiraConfigOut> {