feat(phase-35): Jira + Tempo integration with internal worklogs

Full Jira/Tempo pipeline: link Aegis entities to Jira issues, auto-sync
status hourly, log time internally with integrity hashing, and optionally
push worklogs to Tempo.

- 1.1 JiraLink model + Worklog model: Alembic migration b020 with indexes,
  enums (jiralinkentitytype, jirasyncdirection), and integrity_hash column
- 1.2 Jira service: atlassian-python-api wrapper with lazy singleton client,
  search/create/sync operations, feature-flagged via JIRA_ENABLED
- 1.3 Jira router: CRUD endpoints for /jira/links, /jira/search,
  /jira/create-issue with audit logging and entity-to-issue auto-creation
- 1.4 Tempo service: worklog push via tempo-api-python-client, auto-log from
  test completions when TEMPO_ENABLED, graceful fallback on failure
- 1.5 Worklog service + router: immutable internal time records with SHA-256
  integrity hash, CRUD at /worklogs, /worklogs/{id}/verify endpoint
- 1.6 Frontend: JiraLinkPanel component (search, link, sync, unlink) and
  WorklogTimeline component (timeline view, manual log form) integrated into
  TestDetailPage sidebar, CampaignDetailPage grid, TechniqueDetailPage
- 1.7 Jira sync job: APScheduler hourly job syncs all links from Jira,
  registered in background scheduler alongside existing jobs

backend/alembic/versions/b020_add_jira_links_and_worklogs.py

@@ -0,0 +1,93 @@
+"""add_jira_links_and_worklogs
+
+Revision ID: b020jiraworklogs
+Revises: b019composite
+Create Date: 2026-02-17 16:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+from alembic import op
+
+revision: str = "b020jiraworklogs"
+down_revision: Union[str, None] = "b019composite"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # ── Enums ────────────────────────────────────────────────────────
+    jira_link_entity_type = sa.Enum(
+        "test", "technique", "campaign", "evidence",
+        name="jiralinkentitytype",
+    )
+    jira_sync_direction = sa.Enum(
+        "aegis_to_jira", "jira_to_aegis", "bidirectional",
+        name="jirasyncdirection",
+    )
+    jira_link_entity_type.create(op.get_bind(), checkfirst=True)
+    jira_sync_direction.create(op.get_bind(), checkfirst=True)
+
+    # ── jira_links table ─────────────────────────────────────────────
+    op.create_table(
+        "jira_links",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
+        sa.Column("entity_type", jira_link_entity_type, nullable=False),
+        sa.Column("entity_id", postgresql.UUID(as_uuid=True), nullable=False),
+        sa.Column("jira_issue_key", sa.String(50), nullable=False),
+        sa.Column("jira_issue_id", sa.String(50)),
+        sa.Column("jira_project_key", sa.String(20)),
+        sa.Column("jira_status", sa.String(100)),
+        sa.Column("jira_priority", sa.String(50)),
+        sa.Column("jira_assignee", sa.String(255)),
+        sa.Column("jira_story_points", sa.String(10)),
+        sa.Column("sync_direction", jira_sync_direction, server_default="bidirectional"),
+        sa.Column("last_synced_at", sa.DateTime),
+        sa.Column("sync_metadata", postgresql.JSONB, server_default="{}"),
+        sa.Column("created_by", postgresql.UUID(as_uuid=True), sa.ForeignKey("users.id")),
+        sa.Column("created_at", sa.DateTime, server_default=sa.func.now()),
+        sa.Column("updated_at", sa.DateTime, server_default=sa.func.now()),
+    )
+    op.create_index("ix_jira_links_entity_id", "jira_links", ["entity_id"])
+    op.create_index("ix_jira_links_issue_key", "jira_links", ["jira_issue_key"])
+    op.create_index(
+        "ix_jira_links_entity_type_entity_id",
+        "jira_links",
+        ["entity_type", "entity_id"],
+    )
+
+    # ── worklogs table ───────────────────────────────────────────────
+    op.create_table(
+        "worklogs",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
+        sa.Column("entity_type", sa.String(50), nullable=False),
+        sa.Column("entity_id", postgresql.UUID(as_uuid=True), nullable=False),
+        sa.Column("user_id", postgresql.UUID(as_uuid=True), sa.ForeignKey("users.id"), nullable=False),
+        sa.Column("activity_type", sa.String(100), nullable=False),
+        sa.Column("started_at", sa.DateTime, nullable=False),
+        sa.Column("ended_at", sa.DateTime),
+        sa.Column("duration_seconds", sa.Integer, nullable=False),
+        sa.Column("description", sa.Text),
+        sa.Column("tempo_synced", sa.DateTime),
+        sa.Column("tempo_worklog_id", sa.String(100)),
+        sa.Column("integrity_hash", sa.String(64)),
+        sa.Column("created_at", sa.DateTime, server_default=sa.func.now()),
+        sa.Column("metadata", postgresql.JSONB, server_default="{}"),
+    )
+    op.create_index("ix_worklogs_entity_id", "worklogs", ["entity_id"])
+    op.create_index("ix_worklogs_user_id", "worklogs", ["user_id"])
+    op.create_index(
+        "ix_worklogs_entity_type_entity_id",
+        "worklogs",
+        ["entity_type", "entity_id"],
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("worklogs")
+    op.drop_table("jira_links")
+    sa.Enum(name="jirasyncdirection").drop(op.get_bind(), checkfirst=True)
+    sa.Enum(name="jiralinkentitytype").drop(op.get_bind(), checkfirst=True)