feat(phase-35): Jira + Tempo integration with internal worklogs

Full Jira/Tempo pipeline: link Aegis entities to Jira issues, auto-sync
status hourly, log time internally with integrity hashing, and optionally
push worklogs to Tempo.

- 1.1 JiraLink model + Worklog model: Alembic migration b020 with indexes,
  enums (jiralinkentitytype, jirasyncdirection), and integrity_hash column
- 1.2 Jira service: atlassian-python-api wrapper with lazy singleton client,
  search/create/sync operations, feature-flagged via JIRA_ENABLED
- 1.3 Jira router: CRUD endpoints for /jira/links, /jira/search,
  /jira/create-issue with audit logging and entity-to-issue auto-creation
- 1.4 Tempo service: worklog push via tempo-api-python-client, auto-log from
  test completions when TEMPO_ENABLED, graceful fallback on failure
- 1.5 Worklog service + router: immutable internal time records with SHA-256
  integrity hash, CRUD at /worklogs, /worklogs/{id}/verify endpoint
- 1.6 Frontend: JiraLinkPanel component (search, link, sync, unlink) and
  WorklogTimeline component (timeline view, manual log form) integrated into
  TestDetailPage sidebar, CampaignDetailPage grid, TechniqueDetailPage
- 1.7 Jira sync job: APScheduler hourly job syncs all links from Jira,
  registered in background scheduler alongside existing jobs

frontend/src/api/jira.ts

@@ -0,0 +1,90 @@
+import client from "./client";
+
+// ── Types ───────────────────────────────────────────────────────────
+
+export type JiraLinkEntityType = "test" | "technique" | "campaign" | "evidence";
+export type JiraSyncDirection = "aegis_to_jira" | "jira_to_aegis" | "bidirectional";
+
+export interface JiraLink {
+  id: string;
+  entity_type: JiraLinkEntityType;
+  entity_id: string;
+  jira_issue_key: string;
+  jira_issue_id: string | null;
+  jira_project_key: string | null;
+  jira_status: string | null;
+  jira_priority: string | null;
+  jira_assignee: string | null;
+  jira_story_points: string | null;
+  last_synced_at: string | null;
+  created_at: string;
+}
+
+export interface JiraIssueResult {
+  issue_key: string;
+  summary: string;
+  status: string;
+  assignee: string | null;
+  priority: string | null;
+}
+
+export interface JiraLinkCreatePayload {
+  entity_type: JiraLinkEntityType;
+  entity_id: string;
+  jira_issue_key: string;
+  sync_direction?: JiraSyncDirection;
+}
+
+// ── API Functions ───────────────────────────────────────────────────
+
+/** Search Jira issues by JQL or free text. */
+export async function searchJiraIssues(
+  q: string,
+  maxResults: number = 10,
+): Promise<JiraIssueResult[]> {
+  const { data } = await client.get<JiraIssueResult[]>("/jira/search", {
+    params: { q, max_results: maxResults },
+  });
+  return data;
+}
+
+/** Create a new Jira link for an Aegis entity. */
+export async function createJiraLink(
+  payload: JiraLinkCreatePayload,
+): Promise<JiraLink> {
+  const { data } = await client.post<JiraLink>("/jira/links", payload);
+  return data;
+}
+
+/** List Jira links, optionally filtered. */
+export async function listJiraLinks(params?: {
+  entity_type?: JiraLinkEntityType;
+  entity_id?: string;
+}): Promise<JiraLink[]> {
+  const { data } = await client.get<JiraLink[]>("/jira/links", { params });
+  return data;
+}
+
+/** Force sync a Jira link. */
+export async function syncJiraLink(
+  linkId: string,
+): Promise<{ message: string; jira_status: string }> {
+  const { data } = await client.post(`/jira/links/${linkId}/sync`);
+  return data;
+}
+
+/** Delete a Jira link. */
+export async function deleteJiraLink(linkId: string): Promise<void> {
+  await client.delete(`/jira/links/${linkId}`);
+}
+
+/** Auto-create a Jira issue from an Aegis entity and link them. */
+export async function createIssueFromEntity(
+  entityType: JiraLinkEntityType,
+  entityId: string,
+): Promise<{ issue_key: string; link_id: string }> {
+  const { data } = await client.post("/jira/create-issue", null, {
+    params: { entity_type: entityType, entity_id: entityId },
+  });
+  return data;
+}

frontend/src/api/worklogs.ts

@@ -0,0 +1,62 @@
+import client from "./client";
+
+// ── Types ───────────────────────────────────────────────────────────
+
+export interface Worklog {
+  id: string;
+  entity_type: string;
+  entity_id: string;
+  user_id: string;
+  activity_type: string;
+  started_at: string;
+  ended_at: string | null;
+  duration_seconds: number;
+  description: string | null;
+  tempo_synced: string | null;
+  integrity_hash: string | null;
+  created_at: string;
+}
+
+export interface WorklogCreatePayload {
+  entity_type: string;
+  entity_id: string;
+  activity_type: string;
+  started_at: string;
+  ended_at?: string;
+  duration_seconds: number;
+  description?: string;
+}
+
+// ── API Functions ───────────────────────────────────────────────────
+
+/** Create a manual worklog entry. */
+export async function createWorklog(
+  payload: WorklogCreatePayload,
+): Promise<Worklog> {
+  const { data } = await client.post<Worklog>("/worklogs", payload);
+  return data;
+}
+
+/** List worklogs with optional filters. */
+export async function listWorklogs(params?: {
+  entity_type?: string;
+  entity_id?: string;
+  user_id?: string;
+}): Promise<Worklog[]> {
+  const { data } = await client.get<Worklog[]>("/worklogs", { params });
+  return data;
+}
+
+/** Get a single worklog. */
+export async function getWorklog(worklogId: string): Promise<Worklog> {
+  const { data } = await client.get<Worklog>(`/worklogs/${worklogId}`);
+  return data;
+}
+
+/** Verify a worklog's integrity hash. */
+export async function verifyWorklogIntegrity(
+  worklogId: string,
+): Promise<{ worklog_id: string; integrity_valid: boolean }> {
+  const { data } = await client.get(`/worklogs/${worklogId}/verify`);
+  return data;
+}