fix(assign): exclude admin from assignable operators; sync Jira on assign even for first-time users

Admin can no longer be picked as a red_tech/blue_tech assignee — it
administers the site, it doesn't operate tests. Applied to the
eligible-assignee list on both the picker UI and the assign endpoint's
validation, and dropped from the GET /users/operators pool.

push_assignee_update() now falls back to a fresh Jira account-id lookup
when the assignee hasn't logged in yet (so jira_account_id is still
empty), instead of silently no-op'ing — assignment now syncs to Jira
immediately regardless of whether the assignee has ever logged into
Aegis before.

backend/tests/test_list_operators.py

@@ -44,3 +44,11 @@ def test_manager_can_list_operators(client, manager_headers, red_tech_user):
     assert resp.status_code == 200, resp.text
     usernames = {u["username"] for u in resp.json()}
     assert "redtech" in usernames
+
+
+def test_operators_list_excludes_admin(client, manager_headers, admin_user):
+    """Admin can't be assigned as an operator, so it shouldn't appear in the picker."""
+    resp = client.get("/api/v1/users/operators", headers=manager_headers)
+    assert resp.status_code == 200
+    usernames = {u["username"] for u in resp.json()}
+    assert admin_user.username not in usernames