feat(d3fend): flag review_required on new ATT&CK-D3FEND mappings

Mirrors the existing Atomic/Caldera/Elastic/Sigma/LOLBAS import pattern —
D3FEND mapping import was the one source silently skipping the
review_required flag, so leads never got prompted to review techniques
that only gained new D3FEND coverage.

backend/tests/test_d3fend_import_service.py

@@ -0,0 +1,42 @@
+"""Tests for D3FEND mapping import — review_required trigger parity.
+
+Every other import source (Atomic Red Team, Caldera, Elastic, Sigma, LOLBAS)
+flags a technique with review_required=True when it gains new content, so a
+lead knows to look at it. D3FEND mapping import was missing this — this test
+locks in the fix.
+"""
+
+from app.models.defensive_technique import DefensiveTechnique
+from app.models.technique import Technique
+from app.services.d3fend_import_service import import_d3fend_mappings
+
+
+def test_import_d3fend_mappings_sets_review_required(db):
+    technique = Technique(mitre_id="T1590", name="Gather Victim Network Information", review_required=False)
+    db.add(technique)
+    db.add(DefensiveTechnique(d3fend_id="D3-NTA", name="Network Traffic Analysis"))
+    db.commit()
+
+    result = import_d3fend_mappings(db)
+
+    assert result["created"] >= 1
+    db.refresh(technique)
+    assert technique.review_required is True
+
+
+def test_import_d3fend_mappings_skips_existing_without_reflagging(db):
+    technique = Technique(mitre_id="T1590", name="Gather Victim Network Information", review_required=False)
+    db.add(technique)
+    db.add(DefensiveTechnique(d3fend_id="D3-NTA", name="Network Traffic Analysis"))
+    db.commit()
+
+    import_d3fend_mappings(db)
+    db.refresh(technique)
+    technique.review_required = False
+    db.commit()
+
+    result = import_d3fend_mappings(db)
+
+    assert result["created"] == 0
+    db.refresh(technique)
+    assert technique.review_required is False