feat(campaigns): timeline endpoint, admin-only manual activation, remove lead-set dates

backend/tests/test_campaign_approval_router.py

@@ -254,3 +254,38 @@ def test_direct_add_test_blocked_on_active_campaign_via_router(api, db, red_lead
         json={"test_id": str(new_test.id)},
     )
     assert resp.status_code == 400
+
+
+def test_get_campaign_timeline(api, db, red_lead_user, red_lead_headers):
+    campaign = _make_draft_campaign(db, red_lead_user.id)
+    api("post", f"/api/v1/campaigns/{campaign.id}/submit", red_lead_headers)
+
+    resp = api("get", f"/api/v1/campaigns/{campaign.id}/timeline", red_lead_headers)
+    assert resp.status_code == 200
+    actions = [e["action"] for e in resp.json()]
+    assert "submit_campaign_for_approval" in actions
+
+
+def test_lead_cannot_directly_activate_draft_campaign(api, db, red_lead_user, red_lead_headers):
+    campaign = _make_draft_campaign(db, red_lead_user.id)
+    resp = api("post", f"/api/v1/campaigns/{campaign.id}/activate", red_lead_headers)
+    assert resp.status_code == 403
+
+
+def test_admin_can_still_directly_activate_as_override(api, db, red_lead_user, red_lead_headers, auth_headers):
+    campaign = _make_draft_campaign(db, red_lead_user.id)
+    resp = api("post", f"/api/v1/campaigns/{campaign.id}/activate", auth_headers)
+    assert resp.status_code == 200
+    assert resp.json()["status"] == "active"
+
+
+def test_create_campaign_payload_has_no_start_date_field(api, db, red_lead_headers):
+    resp = api(
+        "post",
+        "/api/v1/campaigns",
+        red_lead_headers,
+        json={"name": "No date campaign", "start_date": "2026-01-01"},
+    )
+    assert resp.status_code == 201
+    # start_date silently ignored — only the manager can ever set it, via /approve
+    assert resp.json()["start_date"] is None