fix(jira): correct browse URL, rename Procedure to Proof of Concept; feat(tempo): debug endpoint + UI

Jira URL fix:
- JiraLinkPanel now fetches the configured Jira base URL via getJiraConfig()
  instead of hardcoding https://jira.atlassian.com; falls back to the old
  value if config is not yet loaded

Description fix:
- _build_test_description: renamed 'h3. Procedure' -> 'h3. Proof of Concept'
  so the procedure/tool block maps to the correct Jira field label

Tempo debug:
- New POST /system/tempo-test endpoint: checks TEMPO_ENABLED, token,
  user jira_account_id, and makes a real API call; always returns HTTP 200
  with status field (Cloudflare-safe)
- docker-compose.prod.yml: added TEMPO_ENABLED, TEMPO_API_TOKEN,
  TEMPO_DEFAULT_WORK_TYPE env vars (default off, ready to enable)
- SettingsPage: added 'Test Tempo Connection' button in Jira admin tab
  with clear feedback showing what's missing

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/routers/system.py

@@ -349,6 +349,71 @@ def test_jira_connection(
         return {"status": "error", "message": msg, "jira_url": jira_url}
 
 
+# ---------------------------------------------------------------------------
+# POST /system/tempo-test
+# ---------------------------------------------------------------------------
+
+
+@router.post("/tempo-test")
+def test_tempo_connection(
+    db: Session = Depends(get_db),
+    current_user: User = Depends(require_role("admin")),
+):
+    """Test the Tempo connection and report configuration status.
+
+    Always returns HTTP 200 with a ``status`` field so Cloudflare never
+    intercepts the response.
+    """
+    from app.config import settings
+
+    if not settings.TEMPO_ENABLED:
+        return {
+            "status": "disabled",
+            "message": "Tempo is not enabled. Set TEMPO_ENABLED=true and TEMPO_API_TOKEN in your environment.",
+        }
+
+    if not settings.TEMPO_API_TOKEN:
+        return {
+            "status": "error",
+            "message": "TEMPO_API_TOKEN is empty. Add it to your environment.",
+        }
+
+    jira_account_id = getattr(current_user, "jira_account_id", None)
+    if not jira_account_id:
+        return {
+            "status": "error",
+            "message": (
+                "Your user has no Jira Account ID configured. "
+                "Set it in Settings → Profile → Jira Integration → Account ID."
+            ),
+        }
+
+    try:
+        from tempoapiclient import client_v4 as tempo_client
+        tempo = tempo_client.Tempo(auth_token=settings.TEMPO_API_TOKEN)
+        # Fetch current user's worklogs as a connectivity check (limit 1)
+        worklogs = tempo.get_worklogs_by_account_id(
+            account_id=jira_account_id,
+            dateFrom="2024-01-01",
+            dateTo="2024-01-02",
+        )
+        return {
+            "status": "ok",
+            "message": f"Tempo connected. Account ID: {jira_account_id}",
+            "worklogs_found": len(worklogs) if isinstance(worklogs, list) else "n/a",
+        }
+    except Exception as exc:
+        err = str(exc)
+        if "401" in err or "Unauthorized" in err:
+            msg = "Authentication failed (401). Check your TEMPO_API_TOKEN."
+        elif "403" in err or "Forbidden" in err:
+            msg = "Access denied (403). The Tempo token may not have the required permissions."
+        else:
+            msg = f"Tempo connection failed: {err}"
+        logger.warning("Tempo test connection failed: %s", err)
+        return {"status": "error", "message": msg}
+
+
 # ---------------------------------------------------------------------------
 # GET /system/email-config
 # ---------------------------------------------------------------------------