feat(permissions): admin no longer acts on the test workflow; managers coordinate operators

Admin administers the site — it no longer has any override on
validate-red/blue, review-red/blue, resolve-dispute, request-discussion,
reopen, hold, resume, assign-operators, or classification-update.
Introduces require_any_role_strict(), a role dependency without the
global admin bypass, so these specific endpoints truly exclude admin
instead of only removing it from the (redundant) role tuple.

Managers gain the ability to assign red_tech/blue_tech operators
(POST /tests/{id}/assign, GET /users/operators) alongside leads, since
that's coordination, not resolving a ticket.

Also enlarges and repositions the operator-assignment controls next
to the Start Execution button, and fixes a literal '\u2014' rendering
as text instead of an em dash in the test detail technique line.

backend/app/routers/users.py

@@ -13,7 +13,7 @@ from sqlalchemy.orm import Session
 from app.database import get_db
 
 # Import require_role from app.dependencies.auth
-from app.dependencies.auth import require_role, require_any_role
+from app.dependencies.auth import require_role, require_any_role_strict
 
 # Import UnitOfWork from app.domain.unit_of_work
 from app.domain.unit_of_work import UnitOfWork
@@ -156,13 +156,13 @@ def create_user_route(
 @router.get("/operators", response_model=list[UserOperatorOut])
 def list_operators_route(
     db: Session = Depends(get_db),
-    current_user: User = Depends(require_any_role("admin", "red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role_strict("manager", "red_lead", "blue_lead")),
 ) -> list[UserOperatorOut]:
-    """Return active red/blue operators and leads, for lead/admin assignment pickers.
+    """Return active red/blue operators and leads, for lead/manager assignment pickers.
 
-    Deliberately excludes viewers and managers, and returns only
-    id/username/role — no emails or tokens — since this is reachable by
-    non-admin leads.
+    Not reachable by admin — admin administers the site, leads/managers
+    coordinate operators. Returns only id/username/role — no emails or
+    tokens — since this is reachable by non-admin leads.
     """
     return (
         db.query(User)