fix(tests): fix veto bug preventing disputed state, add manager notification and dispute-resolution routing

backend/app/routers/tests.py

@@ -17,6 +17,7 @@ POST   /tests/{id}/submit-blue       — blue_evaluating → blue_review
 POST   /tests/{id}/review-blue       — assigned Blue Lead approves/reopens/flags gap
 POST   /tests/{id}/validate-red      — Red Lead validates
 POST   /tests/{id}/validate-blue     — Blue Lead validates
+POST   /tests/{id}/resolve-dispute   — approver flips to reject, routes to red/blue queue
 POST   /tests/{id}/reopen            — rejected → draft
 GET    /tests/{id}/timeline          — audit-log history for this test
 
@@ -69,6 +70,7 @@ from app.schemas.test import (
     TestRedUpdate,
     TestRedValidate,
     TestRemediationUpdate,
+    TestResolveDispute,
     TestUpdate,
 )
 
@@ -143,6 +145,7 @@ from app.services.test_workflow_service import (
     start_blue_work as wf_start_blue_work,
     validate_as_red_lead as wf_validate_red,
     validate_as_blue_lead as wf_validate_blue,
+    resolve_dispute as wf_resolve_dispute,
     reopen_test as wf_reopen,
     handle_remediation_completed as wf_handle_remediation,
     get_retest_chain as wf_get_retest_chain,
@@ -1158,6 +1161,27 @@ def validate_blue(
     return test
 
 
+# ---------------------------------------------------------------------------
+# POST /tests/{id}/resolve-dispute  —  approver flips to reject, picks a queue
+# ---------------------------------------------------------------------------
+
+
+@router.post("/{test_id}/resolve-dispute", response_model=TestOut)
+def resolve_dispute(
+    test_id: uuid.UUID,
+    payload: TestResolveDispute,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(require_any_role("red_lead", "blue_lead", "admin")),
+) -> TestOut:
+    """The lead who approved flips their vote to reject, choosing which team must redo the work."""
+    test = crud_get_test_with_technique(db, test_id)
+    with UnitOfWork(db) as uow:
+        test = wf_resolve_dispute(db, test, current_user, payload.target_team, notes=payload.notes)
+        uow.commit()
+    db.refresh(test)
+    return test
+
+
 # ---------------------------------------------------------------------------
 # POST /tests/{id}/reopen  —  rejected → draft
 # ---------------------------------------------------------------------------