fix(permissions): admin can no longer operate tests — start/submit/edit/create, view only

Admin still bypassed require_any_role (non-strict) on the pure
operator actions: start-execution, submit-red, start-blue-work,
submit-blue, pause/resume-timer, and the red/blue field-edit + general
test create/update/remediation/import-rt/template endpoints all used
the loose dependency even where admin wasn't in the role tuple.
Switched every one of these to require_any_role_strict, matching the
review/validate/dispute/hold/assign endpoints already fixed earlier.

Frontend: removed every remaining role === "admin" disjunct gating
Start Execution, Submit to Blue Team, blue evaluating actions, timer
control, red/blue field editing, test creation, and template creation.
Team-blindness visibility (isBlind) deliberately keeps the admin
bypass — admin still sees both sides unmasked for oversight, since
that's visibility, not operating.

Updated ~20 tests whose fixtures used the admin account as a
convenience shortcut to create/drive tests through the workflow —
switched them to a red_lead account, fixing an incidental
fixture-resolution-order cookie bug along the way (client's cookie
jar prefers the last-logged-in role's cookie over any Bearer header
explicitly passed to a later request).

backend/tests/test_admin_excluded_from_test_workflow.py

@@ -26,8 +26,39 @@ DUMMY_ID = str(uuid.uuid4())
         ("post", f"/api/v1/tests/{DUMMY_ID}/resume", None),
         ("post", f"/api/v1/tests/{DUMMY_ID}/assign", {"red_tech_assignee": DUMMY_ID}),
         ("patch", f"/api/v1/tests/{DUMMY_ID}/classification", {"data_classification": "pii"}),
+        ("post", f"/api/v1/tests/{DUMMY_ID}/start-execution", None),
+        ("post", f"/api/v1/tests/{DUMMY_ID}/submit-red", None),
+        ("post", f"/api/v1/tests/{DUMMY_ID}/start-blue-work", None),
+        ("post", f"/api/v1/tests/{DUMMY_ID}/submit-blue", None),
+        ("post", f"/api/v1/tests/{DUMMY_ID}/pause-timer", None),
+        ("post", f"/api/v1/tests/{DUMMY_ID}/resume-timer", None),
+        ("patch", f"/api/v1/tests/{DUMMY_ID}/red", {"procedure_text": "x"}),
+        ("patch", f"/api/v1/tests/{DUMMY_ID}/blue", {"detection_result": "detected"}),
+        ("patch", f"/api/v1/tests/{DUMMY_ID}", {"name": "x"}),
+        ("patch", f"/api/v1/tests/{DUMMY_ID}/remediation", {"remediation_status": "completed"}),
+        ("post", "/api/v1/tests", {"technique_id": DUMMY_ID, "name": "x"}),
+        ("post", "/api/v1/tests/from-template", {"template_id": DUMMY_ID, "technique_id": DUMMY_ID}),
+        ("post", "/api/v1/tests/import-rt", {"name": "x", "techniques": []}),
     ],
 )
 def test_admin_forbidden(client, auth_headers, method, path, payload):
     resp = getattr(client, method)(path, json=payload, headers=auth_headers)
     assert resp.status_code == 403, f"{method.upper()} {path} -> {resp.status_code}: {resp.text}"
+
+
+@pytest.mark.parametrize(
+    "method,path,payload",
+    [
+        ("post", "/api/v1/test-templates", {"name": "x", "mitre_technique_id": "T1059"}),
+        ("patch", f"/api/v1/test-templates/{DUMMY_ID}", {"name": "x"}),
+        ("patch", f"/api/v1/test-templates/{DUMMY_ID}/toggle-active", None),
+        ("delete", f"/api/v1/test-templates/{DUMMY_ID}", None),
+        ("patch", "/api/v1/test-templates/bulk-activate", {"template_ids": [DUMMY_ID], "is_active": True}),
+    ],
+)
+def test_admin_forbidden_templates(client, auth_headers, method, path, payload):
+    kwargs = {"headers": auth_headers}
+    if payload is not None:
+        kwargs["json"] = payload
+    resp = getattr(client, method)(path, **kwargs)
+    assert resp.status_code == 403, f"{method.upper()} {path} -> {resp.status_code}: {resp.text}"