fix(permissions): admin can no longer operate tests — start/submit/edit/create, view only

Admin still bypassed require_any_role (non-strict) on the pure
operator actions: start-execution, submit-red, start-blue-work,
submit-blue, pause/resume-timer, and the red/blue field-edit + general
test create/update/remediation/import-rt/template endpoints all used
the loose dependency even where admin wasn't in the role tuple.
Switched every one of these to require_any_role_strict, matching the
review/validate/dispute/hold/assign endpoints already fixed earlier.

Frontend: removed every remaining role === "admin" disjunct gating
Start Execution, Submit to Blue Team, blue evaluating actions, timer
control, red/blue field editing, test creation, and template creation.
Team-blindness visibility (isBlind) deliberately keeps the admin
bypass — admin still sees both sides unmasked for oversight, since
that's visibility, not operating.

Updated ~20 tests whose fixtures used the admin account as a
convenience shortcut to create/drive tests through the workflow —
switched them to a red_lead account, fixing an incidental
fixture-resolution-order cookie bug along the way (client's cookie
jar prefers the last-logged-in role's cookie over any Bearer header
explicitly passed to a later request).

backend/tests/test_review_gates_router.py

@@ -86,7 +86,7 @@ def test_review_red_forbidden_for_non_assigned_lead(
     client, db, api, auth_headers, red_tech_headers, red_lead_headers, red_lead_user, technique
 ):
     """A red_lead who isn't the assigned reviewer gets 403."""
-    test_id = _reach_red_review(client, db, api, auth_headers, red_tech_headers, technique)
+    test_id = _reach_red_review(client, db, api, red_lead_headers, red_tech_headers, technique)
     # red_lead_user IS the only red_lead fixture, so it WILL be auto-assigned
     # as reviewer (single-candidate load balancing). To exercise the 403
     # path we need a second, non-assigned red_lead.
@@ -112,7 +112,7 @@ def test_review_red_forbidden_for_non_assigned_lead(
 def test_review_red_approve_moves_to_blue_evaluating(
     client, db, api, auth_headers, red_tech_headers, red_lead_headers, red_lead_user, technique
 ):
-    test_id = _reach_red_review(client, db, api, auth_headers, red_tech_headers, technique)
+    test_id = _reach_red_review(client, db, api, red_lead_headers, red_tech_headers, technique)
 
     resp = api("post", f"/api/v1/tests/{test_id}/review-red", red_lead_headers, json={"decision": "approve", "notes": "LGTM"})
     assert resp.status_code == 200, resp.text
@@ -125,7 +125,7 @@ def test_review_red_approve_moves_to_blue_evaluating(
 def test_review_red_reopen_requires_notes(
     client, db, api, auth_headers, red_tech_headers, red_lead_headers, red_lead_user, technique
 ):
-    test_id = _reach_red_review(client, db, api, auth_headers, red_tech_headers, technique)
+    test_id = _reach_red_review(client, db, api, red_lead_headers, red_tech_headers, technique)
 
     resp = api("post", f"/api/v1/tests/{test_id}/review-red", red_lead_headers, json={"decision": "reopen"})
     assert resp.status_code == 400
@@ -134,7 +134,7 @@ def test_review_red_reopen_requires_notes(
 def test_review_red_reopen_moves_to_red_executing(
     client, db, api, auth_headers, red_tech_headers, red_lead_headers, red_lead_user, technique
 ):
-    test_id = _reach_red_review(client, db, api, auth_headers, red_tech_headers, technique)
+    test_id = _reach_red_review(client, db, api, red_lead_headers, red_tech_headers, technique)
 
     resp = api("post", f"/api/v1/tests/{test_id}/review-red", red_lead_headers, json={"decision": "reopen", "notes": "add more detail"})
     assert resp.status_code == 200, resp.text
@@ -144,11 +144,11 @@ def test_review_red_reopen_moves_to_red_executing(
 
 
 def test_review_red_forbidden_for_admin(
-    client, db, api, auth_headers, red_tech_headers, red_lead_user, technique
+    client, db, api, auth_headers, red_tech_headers, red_lead_headers, red_lead_user, technique
 ):
     """Admin administers the site, not the test workflow — reviewing is a
     red_lead-only action now, with no admin override."""
-    test_id = _reach_red_review(client, db, api, auth_headers, red_tech_headers, technique)
+    test_id = _reach_red_review(client, db, api, red_lead_headers, red_tech_headers, technique)
 
     resp = api("post", f"/api/v1/tests/{test_id}/review-red", auth_headers, json={"decision": "approve"})
     assert resp.status_code == 403
@@ -163,7 +163,7 @@ def test_review_blue_forbidden_for_non_assigned_lead(
     client, db, api, auth_headers, red_tech_headers, red_lead_headers, blue_tech_headers, blue_lead_headers,
     red_lead_user, blue_lead_user, technique,
 ):
-    test_id = _reach_blue_review(client, db, api, auth_headers, red_tech_headers, red_lead_headers, blue_tech_headers, technique)
+    test_id = _reach_blue_review(client, db, api, red_lead_headers, red_tech_headers, red_lead_headers, blue_tech_headers, technique)
 
     from app.auth import hash_password
     from app.models.user import User
@@ -187,7 +187,7 @@ def test_review_blue_approve_moves_to_in_review(
     client, db, api, auth_headers, red_tech_headers, red_lead_headers, blue_tech_headers, blue_lead_headers,
     red_lead_user, blue_lead_user, technique,
 ):
-    test_id = _reach_blue_review(client, db, api, auth_headers, red_tech_headers, red_lead_headers, blue_tech_headers, technique)
+    test_id = _reach_blue_review(client, db, api, red_lead_headers, red_tech_headers, red_lead_headers, blue_tech_headers, technique)
 
     resp = api("post", f"/api/v1/tests/{test_id}/review-blue", blue_lead_headers, json={"decision": "approve"})
     assert resp.status_code == 200, resp.text
@@ -198,7 +198,7 @@ def test_review_blue_reopen_requires_notes(
     client, db, api, auth_headers, red_tech_headers, red_lead_headers, blue_tech_headers, blue_lead_headers,
     red_lead_user, blue_lead_user, technique,
 ):
-    test_id = _reach_blue_review(client, db, api, auth_headers, red_tech_headers, red_lead_headers, blue_tech_headers, technique)
+    test_id = _reach_blue_review(client, db, api, red_lead_headers, red_tech_headers, red_lead_headers, blue_tech_headers, technique)
 
     resp = api("post", f"/api/v1/tests/{test_id}/review-blue", blue_lead_headers, json={"decision": "reopen"})
     assert resp.status_code == 400
@@ -208,7 +208,7 @@ def test_review_blue_reopen_moves_to_blue_evaluating(
     client, db, api, auth_headers, red_tech_headers, red_lead_headers, blue_tech_headers, blue_lead_headers,
     red_lead_user, blue_lead_user, technique,
 ):
-    test_id = _reach_blue_review(client, db, api, auth_headers, red_tech_headers, red_lead_headers, blue_tech_headers, technique)
+    test_id = _reach_blue_review(client, db, api, red_lead_headers, red_tech_headers, red_lead_headers, blue_tech_headers, technique)
 
     resp = api("post", f"/api/v1/tests/{test_id}/review-blue", blue_lead_headers, json={"decision": "reopen", "notes": "redo detection"})
     assert resp.status_code == 200, resp.text
@@ -221,7 +221,7 @@ def test_review_blue_gap_requires_system_gaps(
     client, db, api, auth_headers, red_tech_headers, red_lead_headers, blue_tech_headers, blue_lead_headers,
     red_lead_user, blue_lead_user, technique,
 ):
-    test_id = _reach_blue_review(client, db, api, auth_headers, red_tech_headers, red_lead_headers, blue_tech_headers, technique)
+    test_id = _reach_blue_review(client, db, api, red_lead_headers, red_tech_headers, red_lead_headers, blue_tech_headers, technique)
 
     resp = api("post", f"/api/v1/tests/{test_id}/review-blue", blue_lead_headers, json={"decision": "gap"})
     assert resp.status_code == 400
@@ -231,7 +231,7 @@ def test_review_blue_gap_moves_to_in_review_with_system_gaps(
     client, db, api, auth_headers, red_tech_headers, red_lead_headers, blue_tech_headers, blue_lead_headers,
     red_lead_user, blue_lead_user, technique,
 ):
-    test_id = _reach_blue_review(client, db, api, auth_headers, red_tech_headers, red_lead_headers, blue_tech_headers, technique)
+    test_id = _reach_blue_review(client, db, api, red_lead_headers, red_tech_headers, red_lead_headers, blue_tech_headers, technique)
 
     resp = api(
         "post", f"/api/v1/tests/{test_id}/review-blue", blue_lead_headers,