fix(assign): exclude admin from assignable operators; sync Jira on assign even for first-time users

Admin can no longer be picked as a red_tech/blue_tech assignee — it
administers the site, it doesn't operate tests. Applied to the
eligible-assignee list on both the picker UI and the assign endpoint's
validation, and dropped from the GET /users/operators pool.

push_assignee_update() now falls back to a fresh Jira account-id lookup
when the assignee hasn't logged in yet (so jira_account_id is still
empty), instead of silently no-op'ing — assignment now syncs to Jira
immediately regardless of whether the assignee has ever logged into
Aegis before.

backend/tests/test_assign_operators.py

@@ -55,6 +55,19 @@ def test_assign_rejects_wrong_role_for_side(client, db, red_lead_headers, red_le
     assert resp.status_code == 400
 
 
+def test_admin_cannot_be_assigned_as_operator(client, db, red_lead_headers, red_lead_user, admin_user):
+    """Admin administers the site and can't be assigned as an operator either."""
+    technique = _seed_technique(db)
+    test = _seed_test(db, technique, red_lead_user.id)
+
+    resp = client.post(
+        f"/api/v1/tests/{test.id}/assign",
+        json={"red_tech_assignee": str(admin_user.id)},
+        headers=red_lead_headers,
+    )
+    assert resp.status_code == 400
+
+
 def test_red_tech_cannot_assign(client, db, red_tech_headers, red_tech_user):
     technique = _seed_technique(db)
     test = _seed_test(db, technique, red_tech_user.id)