fix: multiple test-workflow bugs — draft wipe, dark date pickers, Jira status strings, Tempo gate, hold timer

- Fix the red/blue draft form losing unsaved fields (e.g. execution_start_time) whenever an evidence upload refetches the test — the hydration effect now runs once per test, not on every refetch.
- Add color-scheme: dark so native date/time picker popups match the app theme instead of rendering white.
- Fix _STATE_TO_JIRA_STATUS: real Jira statuses are 'To Do' and 'Red Team test review', not 'To-Do' and 'RT Test Review' — confirmed live against the actual workflow transitions, which is why Submit to Blue Team never moved the ticket past 'In Progress'.
- Tempo worklog sync was silently blocked by TEMPO_ENABLED defaulting to False with no admin-facing toggle, even after configuring a Tempo token via Settings. Now bypassed once an admin or personal token is actually configured, mirroring Jira's DB-backed enabled flag.
- Hold now actually pauses the running phase timer (paused_at), and Resume accumulates the held duration into red/blue_paused_seconds — previously the timer kept counting through a hold.

backend/tests/test_tempo_service.py

@@ -12,13 +12,55 @@ from app.services import tempo_service
 
 
 def test_auto_log_test_worklog_skips_when_disabled(monkeypatch, db):
+    """No env kill-switch, no admin token, no personal token — must no-op."""
     monkeypatch.setattr("app.services.tempo_service.settings.TEMPO_ENABLED", False)
     test = MagicMock()
     test.id = uuid4()
     user = MagicMock()
+    user.tempo_api_token = None
     assert tempo_service.auto_log_test_worklog(db, test, user, "red_team_execution") is None
 
 
+@patch("tempoapiclient.client_v4.Tempo")
+def test_auto_log_test_worklog_proceeds_with_admin_token_even_when_disabled(
+    mock_tempo_cls, monkeypatch, db, admin_user
+):
+    """Regression: TEMPO_ENABLED defaults False with no UI toggle — an admin
+    who configures a Tempo token via Settings must not be silently blocked."""
+    monkeypatch.setattr("app.services.tempo_service.settings.TEMPO_ENABLED", False)
+    from app.models.system_config import SystemConfig
+    db.add(SystemConfig(key="tempo.admin_token", value="admin-tempo-token"))
+
+    test_id = uuid4()
+    link = JiraLink(
+        entity_type=JiraLinkEntityType.test,
+        entity_id=test_id,
+        jira_issue_key="TST-11",
+        jira_issue_id="10011",
+        created_by=admin_user.id,
+    )
+    db.add(link)
+    admin_user.tempo_api_token = None  # relying on the admin token, not a personal one
+    admin_user.jira_account_id = "jira-account-123"
+    db.commit()
+
+    mock_tempo_instance = MagicMock()
+    mock_tempo_instance.create_worklog.return_value = {"id": "wl-2"}
+    mock_tempo_cls.return_value = mock_tempo_instance
+
+    test = MagicMock()
+    test.id = test_id
+    test.name = "Phishing simulation"
+    test.red_started_at = datetime(2026, 5, 18, 10, 0, 0)
+    test.updated_at = datetime(2026, 5, 18, 12, 0, 0)
+    test.created_at = test.updated_at
+
+    result = tempo_service.auto_log_test_worklog(db, test, admin_user, "red_team_execution")
+
+    assert result == {"id": "wl-2"}
+    mock_tempo_instance.create_worklog.assert_called_once()
+
+
 def test_get_tempo_client_raises_when_disabled(monkeypatch):
     monkeypatch.setattr("app.services.tempo_service.settings.TEMPO_ENABLED", False)
     with pytest.raises(InvalidOperationError, match="not enabled"):