fix(campaigns,tests): admin cannot create campaigns, manager can delete unstarted tests, intensify red/blue team colors

- Campaign creation and generate-from-threat-actor now use the strict
  role check — admin no longer gets a free pass into campaign content,
  same principle already applied to test-template creation.
- New manager-only DELETE /tests/{id}: removes a standalone test still
  in draft (not started, not linked to any campaign).
- Replaced the orange/indigo stand-ins used across team badges, tabs,
  action buttons, and timers with true red/blue so Red Team and Blue
  Team read unambiguously at a glance.

backend/app/routers/campaigns.py

@@ -25,7 +25,7 @@ from sqlalchemy.orm import Session
 from app.database import get_db
 
 # Import get_current_user, require_any_role from app.dependencies.auth
-from app.dependencies.auth import get_current_user, require_any_role
+from app.dependencies.auth import get_current_user, require_any_role, require_any_role_strict
 
 # Import UnitOfWork from app.domain.unit_of_work
 from app.domain.unit_of_work import UnitOfWork
@@ -319,7 +319,10 @@ def create_campaign(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead", "manager")),
+    # Strict variant — admin must NOT get a free pass here. Admin
+    # administers the site, not campaign content; the only admin path to
+    # an active campaign is the emergency /activate override below.
+    current_user: User = Depends(require_any_role_strict("red_lead", "blue_lead", "manager")),
 ) -> dict:
     """Create a new campaign.
 
@@ -987,7 +990,9 @@ def generate_campaign_from_actor(
     payload: GenerateFromActorPayload = GenerateFromActorPayload(),
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    # Strict variant — admin must NOT get a free pass here, same as the
+    # plain create_campaign endpoint above.
+    current_user: User = Depends(require_any_role_strict("red_lead", "blue_lead")),
 ) -> dict:
     """Auto-generate a campaign from a threat actor's uncovered techniques.