fix(assign): exclude admin from assignable operators; sync Jira on assign even for first-time users

Admin can no longer be picked as a red_tech/blue_tech assignee — it
administers the site, it doesn't operate tests. Applied to the
eligible-assignee list on both the picker UI and the assign endpoint's
validation, and dropped from the GET /users/operators pool.

push_assignee_update() now falls back to a fresh Jira account-id lookup
when the assignee hasn't logged in yet (so jira_account_id is still
empty), instead of silently no-op'ing — assignment now syncs to Jira
immediately regardless of whether the assignee has ever logged into
Aegis before.

backend/app/services/jira_service.py

@@ -893,7 +893,15 @@ def push_assignee_update(db: Session, test: Test, assignee: User) -> None:
 
     jira_account_id = getattr(assignee, "jira_account_id", None)
     if not jira_account_id:
-        return
+        # Normally populated on login (see lookup_user_jira_account_id) —
+        # but a lead may assign someone who has never logged in yet. Try
+        # a fresh lookup now instead of silently giving up, so assignment
+        # still syncs to Jira immediately.
+        lookup_user_jira_account_id(db, assignee)
+        db.flush()
+        jira_account_id = getattr(assignee, "jira_account_id", None)
+        if not jira_account_id:
+            return
 
     try:
         jira = get_admin_jira_client(db)