fix(assign): exclude admin from assignable operators; sync Jira on assign even for first-time users

Admin can no longer be picked as a red_tech/blue_tech assignee — it
administers the site, it doesn't operate tests. Applied to the
eligible-assignee list on both the picker UI and the assign endpoint's
validation, and dropped from the GET /users/operators pool.

push_assignee_update() now falls back to a fresh Jira account-id lookup
when the assignee hasn't logged in yet (so jira_account_id is still
empty), instead of silently no-op'ing — assignment now syncs to Jira
immediately regardless of whether the assignee has ever logged into
Aegis before.

backend/tests/test_jira_service.py

@@ -488,6 +488,7 @@ def test_push_assignee_update_assigns_jira_issue(mock_get_client, mock_configure
 @patch("app.services.jira_service.get_admin_jira_client")
 def test_push_assignee_update_noop_without_jira_account_id(mock_get_client, mock_configured, db):
     mock_jira = MagicMock()
+    mock_jira.user_find_by_user_string.return_value = []  # fallback lookup finds nobody either
     mock_get_client.return_value = mock_jira
     test = _make_test()
     link = _make_link(test.id)
@@ -500,6 +501,29 @@ def test_push_assignee_update_noop_without_jira_account_id(mock_get_client, mock
     mock_jira.assign_issue.assert_not_called()
 
 
+@patch("app.services.jira_service.has_admin_jira_configured", return_value=True)
+@patch("app.services.jira_service.get_admin_jira_client")
+def test_push_assignee_update_looks_up_missing_account_id(mock_get_client, mock_configured, db):
+    """Regression: a lead can assign someone who has never logged in, so
+    jira_account_id isn't populated yet. Must try a fresh lookup instead of
+    silently giving up, so the assignment still syncs immediately."""
+    mock_jira = MagicMock()
+    mock_jira.user_find_by_user_string.return_value = [
+        {"emailAddress": "gerardo.ruiz@kaseya.com", "accountId": "freshly-found-id"}
+    ]
+    mock_get_client.return_value = mock_jira
+    test = _make_test()
+    link = _make_link(test.id)
+    db.add(link)
+    db.commit()
+    assignee = _make_user(jira_account_id=None)
+
+    jira_service.push_assignee_update(db, test, assignee)
+
+    mock_jira.assign_issue.assert_called_once_with(link.jira_issue_key, account_id="freshly-found-id")
+    assert assignee.jira_account_id == "freshly-found-id"
+
+
 @patch("app.services.jira_service.has_admin_jira_configured", return_value=True)
 @patch("app.services.jira_service.get_admin_jira_client")
 def test_push_assignee_update_noop_without_link(mock_get_client, mock_configured, db):