fix(jira): keep BT Start Date across reopens, resolve Jira accounts on the fly everywhere

- BT Start Date had the same bug RT Start Date did: pushed on every round,
  clobbering round 1's real pickup date. Now only pushed on round 1,
  mirroring the "first round survives every reopen" rule.
- push_test_event's assignment branches (red_executing, red/blue reviewer,
  blue_evaluating reassignment) only read the cached jira_account_id and
  silently no-op'd if it was never populated — which is exactly what
  happened to a blue_lead who hadn't logged in since Jira was configured,
  making it look like Blue's reviewer reassignment was broken when Red's
  wasn't purely because that particular red_lead happened to have logged
  in already. Extracted the live-lookup fallback that only
  push_assignee_update had into a shared _resolve_jira_account_id(), used
  by every assignment call site now.

backend/app/services/jira_service.py

@@ -342,6 +342,28 @@ def lookup_user_jira_account_id(db: Session, user: User) -> bool:
         return False
 
 
+def _resolve_jira_account_id(db: Session, user: Optional[User]) -> Optional[str]:
+    """Return *user*'s Atlassian account ID, trying a fresh lookup if it
+    isn't cached yet.
+
+    ``jira_account_id`` is normally populated on login, but a user assigned
+    or reviewing before their first login (or before Jira was configured)
+    would otherwise leave every Jira assignment silently no-op'd forever —
+    exactly the gap that caused a blue_lead's reviews to never reassign in
+    Jira while red_lead's did, since only push_assignee_update had this
+    fallback. Every Jira-assignment call site should use this, not read
+    ``jira_account_id`` directly.
+    """
+    if user is None:
+        return None
+    jira_account_id = getattr(user, "jira_account_id", None)
+    if jira_account_id:
+        return jira_account_id
+    lookup_user_jira_account_id(db, user)
+    db.flush()
+    return getattr(user, "jira_account_id", None)
+
+
 # ---------------------------------------------------------------------------
 # Ticket content builders (inspired by the pentest-to-Jira script)
 # ---------------------------------------------------------------------------
@@ -849,7 +871,7 @@ def push_test_event(
         # it, not the operator who should keep working it — the caller
         # passes the original red_tech_assignee as *assignee* in that case.
         if new_state == "red_executing":
-            jira_account_id = getattr(assignee or actor, "jira_account_id", None)
+            jira_account_id = _resolve_jira_account_id(db, assignee or actor)
             if jira_account_id:
                 try:
                     jira.assign_issue(link.jira_issue_key, account_id=jira_account_id)
@@ -864,7 +886,7 @@ def push_test_event(
                     )
 
         if new_state in ("red_review", "blue_review") and assignee:
-            jira_account_id = getattr(assignee, "jira_account_id", None)
+            jira_account_id = _resolve_jira_account_id(db, assignee)
             if jira_account_id:
                 try:
                     jira.assign_issue(link.jira_issue_key, account_id=jira_account_id)
@@ -887,7 +909,7 @@ def push_test_event(
         if new_state == "blue_evaluating":
             if test.blue_tech_assignee:
                 reassignee = db.query(User).filter(User.id == test.blue_tech_assignee).first()
-                jira_account_id = getattr(reassignee, "jira_account_id", None)
+                jira_account_id = _resolve_jira_account_id(db, reassignee)
             else:
                 jira_account_id = None
             try:
@@ -946,17 +968,9 @@ def push_assignee_update(db: Session, test: Test, assignee: User) -> None:
     if not link:
         return
 
-    jira_account_id = getattr(assignee, "jira_account_id", None)
+    jira_account_id = _resolve_jira_account_id(db, assignee)
     if not jira_account_id:
-        # Normally populated on login (see lookup_user_jira_account_id) —
-        # but a lead may assign someone who has never logged in yet. Try
-        # a fresh lookup now instead of silently giving up, so assignment
-        # still syncs to Jira immediately.
-        lookup_user_jira_account_id(db, assignee)
-        db.flush()
-        jira_account_id = getattr(assignee, "jira_account_id", None)
-        if not jira_account_id:
-            return
+        return
 
     try:
         jira = get_admin_jira_client(db)
@@ -1315,7 +1329,14 @@ def push_rt_submitted(db: Session, test: Test) -> None:
 
 
 def push_bt_started(db: Session, test: Test) -> None:
-    """Set the BT Start Date field — called when Blue picks up the test to evaluate."""
+    """Set the BT Start Date field — called when Blue picks up the test to evaluate.
+
+    Only pushed on round 1. On later rounds (after a reopen), the field
+    already holds round 1's real pickup date and must not be overwritten —
+    same "first round survives every reopen" rule as RT Start Date.
+    """
+    if (test.blue_round_number or 1) > 1:
+        return
     _update_test_fields(db, test, {
         JIRA_FIELD_BT_START_DATE: _jira_datetime(datetime.utcnow()),
     })