feat(tempo): blue team Tempo time from pick-up, not queue entry

Previously blue_started_at was set when the RED team submitted evidence
(= queue open time), so Tempo was getting total queue wait time instead
of actual work time.

Changes:
- DB: add blue_work_started_at column (migration b045), set when a blue
  tech explicitly picks up the test (mirrors red_started_at for red team)
- Workflow: new start_blue_work() function + POST /tests/{id}/start-blue-work
  endpoint (blue_tech / blue_lead roles). Cannot be called twice.
- submit_blue_evidence: uses blue_work_started_at (when available) as the
  phase start for the Tempo worklog, falls back to blue_started_at
- reopen_test: clears blue_work_started_at alongside other timing fields
- Tempo: both red_team_execution and blue_team_evaluation now synced;
  correct work_date and description per activity type
- Frontend: "Start Evaluation" button shown in blue_evaluating state when
  blue_work_started_at is null; live timer shows from pick-up time

What each timestamp tracks:
  blue_started_at      = queue entry (SLA / internal tracking)
  blue_work_started_at = pick-up by blue tech (Tempo start)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/services/tempo_service.py

@@ -11,10 +11,11 @@ all Tempo calls are silently skipped regardless of whether users have tokens.
 
 What goes to Tempo
 ------------------
-Only **red team execution** time is logged to Tempo.  This reflects the time
-the operator (red_tech) spends executing the attack technique — from the moment
-they click "Start" to when they click "Done".  Blue team evaluation time is
-tracked internally in Aegis but is NOT sent to Tempo.
+Both **red team execution** and **blue team evaluation** time are logged to
+Tempo.  Red team time runs from when the red_tech clicks "Start" to "Done".
+Blue team time runs from when the blue_tech clicks "Start Evaluation" (sets
+blue_work_started_at) to when they submit, so it reflects actual working time
+rather than queue time.
 """
 
 import logging
@@ -28,10 +29,8 @@ from app.models.jira_link import JiraLink, JiraLinkEntityType
 
 logger = logging.getLogger(__name__)
 
-# Only these activity types are forwarded to Tempo.
-# "blue_team_evaluation" is intentionally excluded — it is tracked in Aegis
-# but does not represent operator execution work.
-_TEMPO_ACTIVITY_TYPES = {"red_team_execution"}
+# Activity types forwarded to Tempo.
+_TEMPO_ACTIVITY_TYPES = {"red_team_execution", "blue_team_evaluation"}
 
 
 def has_tempo_configured(user) -> bool:
@@ -104,7 +103,7 @@ def auto_log_test_worklog(
     Returns the Tempo worklog response dict, or ``None`` if skipped.
     Completely non-fatal — errors are logged and swallowed.
     """
-    # Only operator execution time goes to Tempo
+    # Only whitelisted activity types go to Tempo
     if activity_type not in _TEMPO_ACTIVITY_TYPES:
         logger.debug(
             "Skipping Tempo sync for activity_type=%s (not in whitelist)", activity_type
@@ -152,19 +151,27 @@ def auto_log_test_worklog(
         return None
 
     try:
-        # Use red_started_at date as the worklog date so it matches when the
+        # Use the phase start timestamp as the worklog date so it matches when
         # work actually happened (not the submission timestamp).
-        work_date = (
-            (test.red_started_at or getattr(test, "updated_at", None) or test.created_at)
-            .strftime("%Y-%m-%d")
-        )
+        if activity_type == "blue_team_evaluation":
+            work_date = (
+                (test.blue_work_started_at or test.blue_started_at or test.created_at)
+                .strftime("%Y-%m-%d")
+            )
+            description = f"[Aegis] Blue Team evaluation: {test.name}"
+        else:
+            work_date = (
+                (test.red_started_at or getattr(test, "updated_at", None) or test.created_at)
+                .strftime("%Y-%m-%d")
+            )
+            description = f"[Aegis] Red Team execution: {test.name}"
         result = log_worklog(
             user=user,
             jira_issue_id=int(link.jira_issue_id),
             author_account_id=jira_account_id,
             date=work_date,
             time_spent_seconds=duration_seconds,
-            description=f"[Aegis] Red Team execution: {test.name}",
+            description=description,
         )
         logger.info(
             "Tempo worklog created for test %s by user %s: %ds on %s",

backend/app/services/test_workflow_service.py

@@ -187,11 +187,46 @@ def submit_red_evidence(db: Session, test: Test, user: User) -> Test:
     return test
 
 
+def start_blue_work(db: Session, test: Test, user: User) -> Test:
+    """Mark that a blue tech has picked up this test to start evaluating.
+
+    Sets blue_work_started_at. Only valid in blue_evaluating state and
+    only if blue_work_started_at is not already set.
+    """
+    if test.state != TestState.blue_evaluating:
+        raise InvalidOperationError(
+            f"Cannot start blue work in '{test.state.value}' state"
+        )
+    if test.blue_work_started_at is not None:
+        raise InvalidOperationError("Blue work already started")
+
+    test.blue_work_started_at = datetime.utcnow()
+    db.flush()
+
+    log_action(
+        db,
+        user_id=user.id,
+        action="start_blue_work",
+        entity_type="test",
+        entity_id=test.id,
+        details={"test_name": test.name},
+    )
+
+    try:
+        notify_test_state_change(db, test, "blue_work_started")
+    except Exception as e:
+        logger.warning("Notification failed for test %s: %s", test.id, e, exc_info=True)
+
+    return test
+
+
 def submit_blue_evidence(db: Session, test: Test, user: User) -> Test:
     """Move from ``blue_evaluating`` → ``in_review``.
 
     Called by **blue_tech** once they have finished documenting detection.
     Stops the Blue Team timer and creates an automatic worklog.
+    Uses blue_work_started_at as the phase start for Tempo if available,
+    otherwise falls back to blue_started_at (queue-entry timestamp).
     """
     now = datetime.utcnow()
 
@@ -206,12 +241,14 @@ def submit_blue_evidence(db: Session, test: Test, user: User) -> Test:
         action_name="submit_blue_evidence",
     )
 
-    # Create automatic worklog for Blue Team phase (subtract paused time)
+    # Create automatic worklog for Blue Team phase (subtract paused time).
+    # Use blue_work_started_at (actual pick-up time) when available so the
+    # Tempo worklog reflects real working time, not just queue time.
     _create_phase_worklog(
         db,
         test=test,
         user=user,
-        phase_started_at=test.blue_started_at,
+        phase_started_at=test.blue_work_started_at or test.blue_started_at,
         phase_ended_at=now,
         paused_seconds=(test.blue_paused_seconds or 0) + paused_extra,
         activity_type="blue_team_evaluation",
@@ -612,6 +649,7 @@ def reopen_test(db: Session, test: Test, user: User) -> Test:
     # Clear phase timing fields
     test.red_started_at = None
     test.blue_started_at = None
+    test.blue_work_started_at = None
     test.paused_at = None
     test.red_paused_seconds = 0
     test.blue_paused_seconds = 0