feat(permissions): admin no longer acts on the test workflow; managers coordinate operators

Admin administers the site — it no longer has any override on
validate-red/blue, review-red/blue, resolve-dispute, request-discussion,
reopen, hold, resume, assign-operators, or classification-update.
Introduces require_any_role_strict(), a role dependency without the
global admin bypass, so these specific endpoints truly exclude admin
instead of only removing it from the (redundant) role tuple.

Managers gain the ability to assign red_tech/blue_tech operators
(POST /tests/{id}/assign, GET /users/operators) alongside leads, since
that's coordination, not resolving a ticket.

Also enlarges and repositions the operator-assignment controls next
to the Start Execution button, and fixes a literal '\u2014' rendering
as text instead of an em dash in the test detail technique line.

backend/app/dependencies/auth.py

@@ -253,6 +253,30 @@ def require_any_role(*roles: str) -> Callable[..., object]:
     return role_checker
 
 
+def require_any_role_strict(*roles: str) -> Callable[..., object]:
+    """Return a FastAPI dependency that enforces **any** of the given *roles*.
+
+    Unlike ``require_any_role``, admins do **not** automatically pass — use
+    this for actions that belong exclusively to Red/Blue operators, leads,
+    or managers (e.g. executing, reviewing, validating, or resolving a
+    disputed test), where "admin" must mean site administration only, not
+    a backdoor into the test workflow itself.
+    """
+
+    async def role_checker(
+        current_user: User = Depends(get_current_user),
+    ) -> User:
+        if current_user.role not in roles:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="Not enough permissions",
+            )
+        _check_api_key_scope(current_user, "write")
+        return current_user
+
+    return role_checker
+
+
 def require_scope(scope: str):
     """Return a dependency that enforces the API key carries *scope*.