fix: multiple test-workflow bugs — draft wipe, dark date pickers, Jira status strings, Tempo gate, hold timer

- Fix the red/blue draft form losing unsaved fields (e.g. execution_start_time) whenever an evidence upload refetches the test — the hydration effect now runs once per test, not on every refetch.
- Add color-scheme: dark so native date/time picker popups match the app theme instead of rendering white.
- Fix _STATE_TO_JIRA_STATUS: real Jira statuses are 'To Do' and 'Red Team test review', not 'To-Do' and 'RT Test Review' — confirmed live against the actual workflow transitions, which is why Submit to Blue Team never moved the ticket past 'In Progress'.
- Tempo worklog sync was silently blocked by TEMPO_ENABLED defaulting to False with no admin-facing toggle, even after configuring a Tempo token via Settings. Now bypassed once an admin or personal token is actually configured, mirroring Jira's DB-backed enabled flag.
- Hold now actually pauses the running phase timer (paused_at), and Resume accumulates the held duration into red/blue_paused_seconds — previously the timer kept counting through a hold.

backend/app/services/tempo_service.py

@@ -6,8 +6,11 @@ Each user authenticates to Tempo with their own personal Tempo API token,
 stored in ``user.tempo_api_token``.  This is different from the Jira API token.
 Obtain a Tempo token at: Jira → Apps → Tempo → Settings → API Integration.
 
-The global ``settings.TEMPO_ENABLED`` flag acts as a kill-switch.  When False,
-all Tempo calls are silently skipped regardless of whether users have tokens.
+The global ``settings.TEMPO_ENABLED`` env var is an optional hard kill-switch
+for ops (e.g. disable entirely in a demo environment). It defaults to False,
+but that default is bypassed automatically once an admin or personal Tempo
+token is actually configured — configuring a token via Settings is enough
+to turn Tempo sync on, same as Jira's DB-backed "enabled" toggle.
 
 What goes to Tempo
 ------------------
@@ -223,8 +226,12 @@ def auto_log_test_worklog(
         logger.debug("Skipping Tempo sync for activity_type=%s", activity_type)
         return None
 
-    # Global kill-switch
-    if not settings.TEMPO_ENABLED:
+    # Global kill-switch — bypassed once an admin or personal Tempo token
+    # is actually configured, mirroring how Jira's DB-backed "enabled"
+    # toggle takes priority over its env-var default. Without this, an
+    # admin who configures a Tempo token via Settings still gets silent
+    # no-ops because TEMPO_ENABLED defaults to False and has no UI toggle.
+    if not settings.TEMPO_ENABLED and not has_admin_tempo_configured(db) and not has_tempo_configured(user):
         return None
 
     # Compute duration from test timestamps when not supplied by the caller