fix(permissions): admin can no longer operate tests — start/submit/edit/create, view only

Admin still bypassed require_any_role (non-strict) on the pure
operator actions: start-execution, submit-red, start-blue-work,
submit-blue, pause/resume-timer, and the red/blue field-edit + general
test create/update/remediation/import-rt/template endpoints all used
the loose dependency even where admin wasn't in the role tuple.
Switched every one of these to require_any_role_strict, matching the
review/validate/dispute/hold/assign endpoints already fixed earlier.

Frontend: removed every remaining role === "admin" disjunct gating
Start Execution, Submit to Blue Team, blue evaluating actions, timer
control, red/blue field editing, test creation, and template creation.
Team-blindness visibility (isBlind) deliberately keeps the admin
bypass — admin still sees both sides unmasked for oversight, since
that's visibility, not operating.

Updated ~20 tests whose fixtures used the admin account as a
convenience shortcut to create/drive tests through the workflow —
switched them to a red_lead account, fixing an incidental
fixture-resolution-order cookie bug along the way (client's cookie
jar prefers the last-logged-in role's cookie over any Bearer header
explicitly passed to a later request).

backend/tests/test_data_classification.py

@@ -49,10 +49,10 @@ def test_new_test_defaults_to_internal_use_only_via_db_default(db, red_lead_user
     assert test.data_classification == "internal_use_only"
 
 
-def test_create_test_endpoint_uses_tactic_heuristic(client, db, api, auth_headers, technique):
+def test_create_test_endpoint_uses_tactic_heuristic(client, db, api, red_lead_headers, red_lead_user, technique):
     """Going through the real create-test flow applies the tactic-based heuristic."""
     resp = api(
-        "post", "/api/v1/tests", auth_headers,
+        "post", "/api/v1/tests", red_lead_headers,
         json={"technique_id": technique["id"], "name": "Heuristic test"},
     )
     assert resp.status_code == 201, resp.text