fix(jira,evidence,tempo,settings): 4-issue fix batch

Jira — PoC custom field:
- Add customfield_10309 (Proof of Concept) to issue fields when creating
  test tickets so the attack procedure appears in the dedicated Jira field

Tempo — blue team exclusion:
- Remove blue_team_evaluation from _TEMPO_ACTIVITY_TYPES; blue team time
  is tracked internally (worklogs) for SLA but never sent to Tempo since
  blue team has no Jira access

Evidence — uploaded_at NULL fix:
- Set uploaded_at=datetime.utcnow() explicitly in upload_evidence router;
  the DB column has no server default so it was saving as NULL

Evidence — presigned URL browser access:
- Add MINIO_PUBLIC_ENDPOINT setting (config.py, docker-compose.prod.yml)
- storage.py uses a dedicated _public_client for presigned URL generation
  so browsers receive URLs with the publicly accessible hostname instead of
  the internal Docker service name (minio:9000)
- Expose MinIO port 9000 in docker-compose.prod.yml

Evidence — Jira attachment:
- After upload to MinIO, call jira.add_attachment() to attach the file to
  the linked Jira ticket (non-fatal; errors are logged and swallowed)

Settings — hide Jira/Tempo from blue team:
- ProfileSection checks user role; blue_lead and blue_tech do not see the
  Jira Integration or Tempo Integration personal settings sections

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/services/jira_service.py

@@ -488,12 +488,15 @@ def auto_create_test_issue(
         parent = parent_ticket_override or get_jira_parent_ticket_standalone(db)
         issue_type = settings.JIRA_ISSUE_TYPE_TEST  # always Task
 
+        poc = test.procedure_text or "N/A"
         fields: dict = {
             "project": {"key": project_key},
             "summary": f"[Aegis] {mitre_id} — {test.name}",
             "description": _build_test_description(test, technique),
             "issuetype": {"name": issue_type},
             "labels": ["aegis", "security-test", mitre_id.replace(".", "-")],
+            # customfield_10309 = Proof of Concept field (required by team's Jira config)
+            "customfield_10309": f"{{code}}{poc}{{code}}",
         }
 
         if parent:

backend/app/services/tempo_service.py

@@ -29,8 +29,10 @@ from app.models.jira_link import JiraLink, JiraLinkEntityType
 
 logger = logging.getLogger(__name__)
 
-# Activity types forwarded to Tempo.
-_TEMPO_ACTIVITY_TYPES = {"red_team_execution", "blue_team_evaluation"}
+# Only red team execution time goes to Tempo.
+# Blue team evaluation time is tracked internally (worklogs table) for SLA
+# purposes but is NOT forwarded to Tempo — blue team has no Jira access.
+_TEMPO_ACTIVITY_TYPES = {"red_team_execution"}
 
 
 def has_tempo_configured(user) -> bool: