feat(permissions): admin no longer acts on the test workflow; managers coordinate operators

Admin administers the site — it no longer has any override on
validate-red/blue, review-red/blue, resolve-dispute, request-discussion,
reopen, hold, resume, assign-operators, or classification-update.
Introduces require_any_role_strict(), a role dependency without the
global admin bypass, so these specific endpoints truly exclude admin
instead of only removing it from the (redundant) role tuple.

Managers gain the ability to assign red_tech/blue_tech operators
(POST /tests/{id}/assign, GET /users/operators) alongside leads, since
that's coordination, not resolving a ticket.

Also enlarges and repositions the operator-assignment controls next
to the Start Execution button, and fixes a literal '\u2014' rendering
as text instead of an em dash in the test detail technique line.

backend/tests/test_data_classification.py

@@ -61,7 +61,9 @@ def test_create_test_endpoint_uses_tactic_heuristic(client, db, api, auth_header
     assert resp.json()["data_classification"] == "internal_use_only"
 
 
-def test_admin_can_update_classification(client, db, admin_user, admin_token, red_lead_user):
+def test_admin_cannot_update_classification(client, db, admin_user, admin_token, red_lead_user):
+    """Admin administers the site, not test content — classification is a
+    lead/manager/operator call."""
     technique = _seed_technique(db)
     test = Test(
         technique_id=technique.id,
@@ -77,6 +79,25 @@ def test_admin_can_update_classification(client, db, admin_user, admin_token, re
         json={"data_classification": "pii"},
         headers={"Authorization": f"Bearer {admin_token}"},
     )
+    assert response.status_code == 403
+
+
+def test_manager_can_update_classification(client, db, manager_user, manager_headers, red_lead_user):
+    technique = _seed_technique(db)
+    test = Test(
+        technique_id=technique.id,
+        name="Classify me",
+        created_by=red_lead_user.id,
+        state=TestState.draft,
+    )
+    db.add(test)
+    db.commit()
+
+    response = client.patch(
+        f"/api/v1/tests/{test.id}/classification",
+        json={"data_classification": "pii"},
+        headers=manager_headers,
+    )
     assert response.status_code == 200
     assert response.json()["data_classification"] == "pii"