fix(assign): exclude admin from assignable operators; sync Jira on assign even for first-time users

Admin can no longer be picked as a red_tech/blue_tech assignee — it
administers the site, it doesn't operate tests. Applied to the
eligible-assignee list on both the picker UI and the assign endpoint's
validation, and dropped from the GET /users/operators pool.

push_assignee_update() now falls back to a fresh Jira account-id lookup
when the assignee hasn't logged in yet (so jira_account_id is still
empty), instead of silently no-op'ing — assignment now syncs to Jira
immediately regardless of whether the assignee has ever logged into
Aegis before.

backend/app/routers/tests.py

@@ -1286,14 +1286,14 @@ def assign_test_operators(
 
     if payload.red_tech_assignee is not None:
         u = db.query(User).filter(User.id == payload.red_tech_assignee).first()
-        if not u or u.role not in ("red_tech", "red_lead", "admin"):
+        if not u or u.role not in ("red_tech", "red_lead"):
             raise HTTPException(status_code=400, detail="Invalid red tech assignee")
         test.red_tech_assignee = payload.red_tech_assignee
         newly_assigned = u
 
     if payload.blue_tech_assignee is not None:
         u = db.query(User).filter(User.id == payload.blue_tech_assignee).first()
-        if not u or u.role not in ("blue_tech", "blue_lead", "admin"):
+        if not u or u.role not in ("blue_tech", "blue_lead"):
             raise HTTPException(status_code=400, detail="Invalid blue tech assignee")
         test.blue_tech_assignee = payload.blue_tech_assignee
         newly_assigned = u

backend/app/routers/users.py

@@ -161,13 +161,14 @@ def list_operators_route(
     """Return active red/blue operators and leads, for lead/manager assignment pickers.
 
     Not reachable by admin — admin administers the site, leads/managers
-    coordinate operators. Returns only id/username/role — no emails or
+    coordinate operators, and admin cannot itself be assigned as an
+    operator either. Returns only id/username/role — no emails or
     tokens — since this is reachable by non-admin leads.
     """
     return (
         db.query(User)
         .filter(
-            User.role.in_(["red_tech", "red_lead", "blue_tech", "blue_lead", "admin"]),
+            User.role.in_(["red_tech", "red_lead", "blue_tech", "blue_lead"]),
             User.is_active.is_(True),
         )
         .order_by(User.username)