fix(assign): exclude admin from assignable operators; sync Jira on assign even for first-time users

Admin can no longer be picked as a red_tech/blue_tech assignee — it
administers the site, it doesn't operate tests. Applied to the
eligible-assignee list on both the picker UI and the assign endpoint's
validation, and dropped from the GET /users/operators pool.

push_assignee_update() now falls back to a fresh Jira account-id lookup
when the assignee hasn't logged in yet (so jira_account_id is still
empty), instead of silently no-op'ing — assignment now syncs to Jira
immediately regardless of whether the assignee has ever logged into
Aegis before.

frontend/src/components/test-detail/AssigneeControl.tsx

@@ -19,8 +19,8 @@ const SIDE_STYLE = {
 };
 
 const SIDE_ROLES: Record<"red" | "blue", string[]> = {
-  red: ["red_tech", "red_lead", "admin"],
-  blue: ["blue_tech", "blue_lead", "admin"],
+  red: ["red_tech", "red_lead"],
+  blue: ["blue_tech", "blue_lead"],
 };
 
 /** Lead/manager picker for the red_tech_assignee / blue_tech_assignee fields. */