feat(test-catalog): add template creation and lead-approval workflow

Leads get a Create Template button that adds directly to the catalog
(existing POST /test-templates). Operators (red_tech/blue_tech) get the
same button, but their proposal now lands in a new template_suggestions
review queue instead — a lead on their team can approve it as-is, edit
fields before approving, or discard it. Modeled on the existing
ProcedureSuggestion review workflow.

backend/alembic/versions/b064_template_suggestions.py

@@ -0,0 +1,54 @@
+"""Add template_suggestions table for operator template proposals.
+
+Leads can already create a TestTemplate directly (POST /test-templates).
+Operators (red_tech/blue_tech) get the same "create template" action, but
+their proposal lands here pending a lead's review instead of the live
+catalog.
+
+Revision ID: b064
+Revises: b063
+Create Date: 2026-07-16
+"""
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import postgresql
+
+revision = "b064"
+down_revision = "b063"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "template_suggestions",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
+        sa.Column("mitre_technique_id", sa.String(), nullable=False),
+        sa.Column("name", sa.String(), nullable=False),
+        sa.Column("description", sa.Text(), nullable=True),
+        sa.Column("source", sa.String(), nullable=False, server_default="custom"),
+        sa.Column("source_url", sa.String(), nullable=True),
+        sa.Column("attack_procedure", sa.Text(), nullable=True),
+        sa.Column("expected_detection", sa.Text(), nullable=True),
+        sa.Column("platform", sa.String(), nullable=True),
+        sa.Column("tool_suggested", sa.String(), nullable=True),
+        sa.Column("severity", sa.String(), nullable=True),
+        sa.Column("atomic_test_id", sa.String(), nullable=True),
+        sa.Column("suggested_remediation", sa.Text(), nullable=True),
+        sa.Column("team", sa.String(10), nullable=False),
+        sa.Column("submitted_by", postgresql.UUID(as_uuid=True), sa.ForeignKey("users.id"), nullable=True),
+        sa.Column("status", sa.String(10), nullable=False, server_default="pending"),
+        sa.Column("reviewed_by", postgresql.UUID(as_uuid=True), sa.ForeignKey("users.id"), nullable=True),
+        sa.Column("reviewed_at", sa.DateTime(), nullable=True),
+        sa.Column("created_template_id", postgresql.UUID(as_uuid=True), sa.ForeignKey("test_templates.id"), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
+    )
+    op.create_index("ix_template_suggestions_status", "template_suggestions", ["status"])
+    op.create_index("ix_template_suggestions_team", "template_suggestions", ["team"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_template_suggestions_team", table_name="template_suggestions")
+    op.drop_index("ix_template_suggestions_status", table_name="template_suggestions")
+    op.drop_table("template_suggestions")