fix(jira): expose non-admin jira-config, drop security-test label; catalog paging

GET /system/jira-config was admin-only, so non-admin users hit a 403
and the frontend silently fell back to a hardcoded jira.atlassian.com
base URL when building /browse/{key} links. Opened it to any
authenticated user (still no secrets returned).

Also drops the redundant 'security-test' Jira label, and adds a
page-size selector (10/25/50/100) and a 'no existing test yet' filter
to the Test Catalog.

backend/tests/test_jira_config_endpoint.py

@@ -0,0 +1,21 @@
+"""GET /system/jira-config must be readable by any authenticated user.
+
+Regression: it used to be admin-only, so non-admin users (e.g. red_lead)
+got a 403 and the frontend silently fell back to a hardcoded
+"https://jira.atlassian.com" base URL when building ticket links.
+"""
+
+
+def test_non_admin_can_read_jira_config(client, red_lead_headers):
+    resp = client.get("/api/v1/system/jira-config", headers=red_lead_headers)
+    assert resp.status_code == 200, resp.text
+    assert "url" in resp.json()
+
+
+def test_non_admin_cannot_update_jira_config(client, red_lead_headers):
+    resp = client.patch(
+        "/api/v1/system/jira-config",
+        json={"url": "https://evil.example.com"},
+        headers=red_lead_headers,
+    )
+    assert resp.status_code == 403

backend/tests/test_jira_service.py

@@ -414,11 +414,11 @@ def test_auto_create_test_issue_adds_platform_label(
     jira_service.auto_create_test_issue(db, test, actor, technique=technique)
 
     labels = mock_jira.issue_create.call_args.kwargs["fields"]["labels"]
-    assert ["aegis", "security-test", "T1003-006"] == labels[:3]
+    assert ["aegis", "T1003-006"] == labels[:2]
     if expected_label:
         assert expected_label in labels
     else:
-        assert len(labels) == 3
+        assert len(labels) == 2
 
 
 def _make_user(**overrides):