fix(permissions): admin can no longer operate tests — start/submit/edit/create, view only

Admin still bypassed require_any_role (non-strict) on the pure
operator actions: start-execution, submit-red, start-blue-work,
submit-blue, pause/resume-timer, and the red/blue field-edit + general
test create/update/remediation/import-rt/template endpoints all used
the loose dependency even where admin wasn't in the role tuple.
Switched every one of these to require_any_role_strict, matching the
review/validate/dispute/hold/assign endpoints already fixed earlier.

Frontend: removed every remaining role === "admin" disjunct gating
Start Execution, Submit to Blue Team, blue evaluating actions, timer
control, red/blue field editing, test creation, and template creation.
Team-blindness visibility (isBlind) deliberately keeps the admin
bypass — admin still sees both sides unmasked for oversight, since
that's visibility, not operating.

Updated ~20 tests whose fixtures used the admin account as a
convenience shortcut to create/drive tests through the workflow —
switched them to a red_lead account, fixing an incidental
fixture-resolution-order cookie bug along the way (client's cookie
jar prefers the last-logged-in role's cookie over any Bearer header
explicitly passed to a later request).

frontend/src/components/test-detail/TeamTabs.tsx

@@ -151,20 +151,21 @@ export default function TeamTabs({
     enabled: !!test.technique_mitre_id,
   });
 
-  // Leads and admins can edit during both draft and executing phases.
-  // Operators (red_tech) may only edit once execution has started —
-  // the timer must be running before they can document the attack.
+  // Leads can edit during both draft and executing phases. Operators
+  // (red_tech) may only edit once execution has started — the timer must
+  // be running before they can document the attack. Admin administers the
+  // site, not test content, so it never gets edit rights here.
   const canEditRed =
     (test.state === "red_executing" &&
-      (role === "red_tech" || role === "red_lead" || role === "admin")) ||
-    (test.state === "draft" && (role === "red_lead" || role === "admin"));
+      (role === "red_tech" || role === "red_lead")) ||
+    (test.state === "draft" && role === "red_lead");
 
   // Blue operators may only edit after they explicitly pick up the test
   // (Start Evaluation pressed → blue_work_started_at is set).
-  // Blue leads and admins can edit at any point during blue_evaluating.
+  // Blue leads can edit at any point during blue_evaluating.
   const canEditBlue =
     BLUE_EDITABLE_STATES.includes(test.state) &&
-    ((role === "blue_lead" || role === "admin") ||
+    (role === "blue_lead" ||
       (role === "blue_tech" && !!test.blue_work_started_at));
 
   // Blind visibility: neither side sees the other's data until both reviews

frontend/src/components/test-detail/TestDetailHeader.tsx

@@ -185,7 +185,7 @@ export default function TestDetailHeader({
     // Red Team in draft -> Start Execution
     if (
       test.state === "draft" &&
-      (role === "red_tech" || role === "red_lead" || role === "admin")
+      (role === "red_tech" || role === "red_lead")
     ) {
       buttons.push(
         <button
@@ -203,7 +203,7 @@ export default function TestDetailHeader({
     // Red Team in red_executing -> Submit to Blue Team (requires ≥1 red evidence)
     if (
       test.state === "red_executing" &&
-      (role === "red_tech" || role === "red_lead" || role === "admin")
+      (role === "red_tech" || role === "red_lead")
     ) {
       const hasRedEvidence = (test.red_evidences?.length ?? 0) > 0;
       buttons.push(
@@ -263,7 +263,7 @@ export default function TestDetailHeader({
     //   - if already picked up: show "Submit for Review" button
     if (
       test.state === "blue_evaluating" &&
-      (role === "blue_tech" || role === "blue_lead" || role === "admin")
+      (role === "blue_tech" || role === "blue_lead")
     ) {
       if (!test.blue_work_started_at) {
         buttons.push(
@@ -481,8 +481,8 @@ export default function TestDetailHeader({
   // ── Live timer ───────────────────────────────────────────────────
 
   const canControlTimer =
-    (test.state === "red_executing" && (role === "red_tech" || role === "red_lead" || role === "admin")) ||
-    (test.state === "blue_evaluating" && (role === "blue_tech" || role === "blue_lead" || role === "admin"));
+    (test.state === "red_executing" && (role === "red_tech" || role === "red_lead")) ||
+    (test.state === "blue_evaluating" && (role === "blue_tech" || role === "blue_lead"));
 
   const renderLiveTimer = () => {
     if (test.state === "red_executing" && test.red_started_at) {

frontend/src/pages/TestCatalogPage.tsx

@@ -80,9 +80,9 @@ export default function TestCatalogPage() {
   const [searchParams, setSearchParams] = useSearchParams();
   const { user } = useAuth();
 
-  // Only leads and admins can create tests from templates
+  // Only leads can create tests from templates — admin administers the
+  // site, not test content.
   const canUseTemplate =
-    user?.role === "admin" ||
     user?.role === "red_lead" ||
     user?.role === "blue_lead";
 

frontend/src/pages/TestDetailPage.tsx

@@ -519,14 +519,13 @@ export default function TestDetailPage() {
   const role = user?.role ?? "";
   const canSaveRed =
     (test.state === "draft" || test.state === "red_executing") &&
-    (role === "red_tech" || role === "red_lead" || role === "admin");
+    (role === "red_tech" || role === "red_lead");
   const canSaveBlue =
     test.state === "blue_evaluating" &&
-    (role === "blue_tech" || role === "blue_lead" || role === "admin");
+    (role === "blue_tech" || role === "blue_lead");
 
-  // Only leads and admins can create templates
-  const canSaveAsTemplate =
-    role === "red_lead" || role === "blue_lead" || role === "admin";
+  // Only leads can create templates — admin administers the site, not test content.
+  const canSaveAsTemplate = role === "red_lead" || role === "blue_lead";
 
   // ── Render ─────────────────────────────────────────────────────
 

frontend/src/pages/TestsPage.tsx

@@ -139,8 +139,8 @@ export default function TestsPage() {
   const navigate = useNavigate();
   const { user } = useAuth();
 
-  const canCreate =
-    user?.role === "admin" || user?.role === "red_lead" || user?.role === "blue_lead";
+  // Only leads can create tests — admin administers the site, not test content.
+  const canCreate = user?.role === "red_lead" || user?.role === "blue_lead";
 
   const techRole = isTechRole(user?.role);