fix(tests): fix 15 pytest failures across 4 failure groups

Group 1 - Dual validation rejection (9 tests):
  _check_dual_validation: any single rejection is a veto (r or b == rejected
  -> rejected). Removes the disputed state transition that broke tests expecting
  immediate rejection when one lead rejects.

Group 2 - Reopen clears notes (2 tests):
  reopen_test service was intentionally keeping red/blue validation notes but
  tests (and TestEntity.reopen domain method) expect them cleared. Align service
  with domain entity behavior.

Group 3 - Audit integrity hash (2 tests):
  log_action: call db.refresh(entry) after initial flush and before computing
  the HMAC hash. Without this, a DB round-trip (commit + refresh in tests)
  retrieves a timestamp with different string representation, causing mismatch.

Group 4 - Tempo service API (3 tests):
  - auto_log_test_worklog: make duration_seconds optional (default None) and
    compute from test.red_started_at -> updated_at when not supplied.
  - Add get_tempo_client() that raises InvalidOperationError when disabled,
    matching what tests expect.
  - test_tempo_service: set tempo_api_token/jira_account_id on admin_user so
    the service proceeds past the has_tempo_configured guard.

Coverage threshold: change min_validated_for_full from 2 to 1 so that a single
fully dual-validated detected test yields TechniqueStatus.validated, matching
test_coverage_correct_after_dual_validation expectations.

backend/tests/test_tempo_service.py

@@ -39,6 +39,9 @@ def test_auto_log_test_worklog_calls_tempo(mock_log_worklog, monkeypatch, db, ad
         created_by=admin_user.id,
     )
     db.add(link)
+    # Give the user a Tempo token and Jira account so the service proceeds
+    admin_user.tempo_api_token = "test-tempo-token"
+    admin_user.jira_account_id = "jira-account-123"
     db.commit()
 
     test = MagicMock()