feat(m7): per-test execution — red/blue zones, evidence pipeline, activity poll

DoD M7 (spec §F5 + §F6 + §F8 + tasks/todo.md M7) covered end-to-end:

Backend
- New migration `91a4e7c6d2f3` adds `mission_tests.last_actor_id` (FK users
  ON DELETE SET NULL) and `ix_mission_tests_updated_at` for the polling query.
- `detection_levels`: 4 default rows seeded at boot, `GET /detection-levels`
  read-only (CRUD lands in M8).
- `mission_tests` service + `missions` API extension:
  - `GET /missions/{id}/tests/{test_id}` — full detail incl. evidence list
  - `PUT  /missions/{id}/tests/{test_id}` — patch red/blue fields with per-field
    perm classification (`mission.write_red_fields` vs `mission.write_blue_fields`)
  - `POST /missions/{id}/tests/{test_id}/transition` — pending↔skipped/blocked
    and pending→executed→reviewed_by_blue (+ undo paths), side-aware perm gate
    that fires *before* idempotency, `executed_at` auto-stamped on the way in
  - `GET  /missions/{id}/activity?since=<ISO>` — drives the 15 s polling badge
- `evidence` service + top-level `/evidence/<id>` API:
  - Streaming upload, SHA256 chunk-by-chunk, 25 MB cap, ext+MIME whitelist
  - Content-addressed storage at ${EVIDENCE_DIR}/<mission>/<test>/<sha256><ext>
  - Atomic `os.replace`, hex-validated SHA path component, root-dir guard
  - Membership-aware (404 on miss/forbidden, no existence leak)
- `/diag/reset` now wipes ${EVIDENCE_DIR}/* in test mode (symlink-safe) and
  re-seeds detection levels as a safety net.

Frontend
- `lib/missions.ts` — M7 types + queryKey factory + state-machine matrix.
- `pages/MissionTestPage.tsx` — two-zone layout: red border (command, output,
  comment, mark-executed + override toggle) and cyan border (detection-level
  select, comment, drag-and-drop evidence dropzone). Last-touched badge polls
  /activity every 15 s, gated on document.visibilityState. Per-field disable
  based on the user's red/blue perms (server stays the arbiter).
- `pages/MissionDetailPage.tsx` — test rows link to the new per-test page.
- `App.tsx` — registers /missions/:id/tests/:testId behind RequireAuth.
- `HomePage.tsx` — hero + roadmap card bumped to M7; next is M8.

Tests
- `backend/tests/test_mission_tests.py` — 27 pytest tests (red/blue field
  gating, state-machine matrix incl. idempotent-side enforcement, executed_at
  override, 24/26 MB upload + SHA256, MIME/ext whitelist, soft-delete hide,
  activity polling with URL-encoded `since`, membership 404 vs admin bypass,
  cross-mission evidence access).
- `e2e/tests/m7-execution.spec.ts` — 5 Playwright tests against the live stack
  (red-only/blue-only API gating, mark-executed + reviewed_by_blue side
  enforcement, 24 MB/26 MB upload + SHA256 round-trip, SPA per-test page save
  + transition, non-member 404 message). afterAll restores stable admin and
  re-syncs MITRE.

Docs
- CHANGELOG.md: M7 section + post-M7 review-pass subsection.
- README.md: status, feature blurb, roadmap, testing-m7 link.
- tasks/testing-m7.md: manual + automated procedure with transition matrix
  and perm-gating table.
- tasks/lessons.md: M7 retrospectives (LogRecord `created` trap, URL-encoded
  query timestamps, perm-before-flush, atomic move, polling visibility gate).

Test count: 133 pytest / 49 Playwright, all green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/api/evidence.py

@@ -0,0 +1,123 @@
+"""Top-level evidence routes (download + soft-delete by id).
+
+Upload is collocated under `/missions/{id}/tests/{test_id}/evidence` because
+that path encodes the parent context. Once an evidence row exists, callers
+can address it by id directly — these routes own that side.
+
+Membership/visibility is enforced through the service (`EvidenceNotFound` is
+returned for both "missing" and "not visible" outcomes — no existence leak).
+"""
+
+from __future__ import annotations
+
+import logging
+import uuid
+from typing import Any
+
+from flask import Blueprint, abort, g, jsonify, request, send_file
+
+from app.core.auth_decorators import AuthenticatedUser, require_auth, require_perm
+from app.services import evidence as svc
+
+bp = Blueprint("evidence", __name__, url_prefix="/evidence")
+log = logging.getLogger("metamorph.api.evidence")
+
+
+def _serialize(ev: svc.EvidenceView) -> dict[str, Any]:
+    return {
+        "id": str(ev.id),
+        "mission_test_id": str(ev.mission_test_id),
+        "sha256": ev.sha256,
+        "mime": ev.mime,
+        "size_bytes": ev.size_bytes,
+        "original_filename": ev.original_filename,
+        "uploaded_by_user_id": (
+            str(ev.uploaded_by_user_id) if ev.uploaded_by_user_id else None
+        ),
+        "uploaded_by_email": ev.uploaded_by_email,
+        "uploaded_by_display_name": ev.uploaded_by_display_name,
+        "uploaded_at": ev.uploaded_at.isoformat(),
+        "created_at": ev.created_at.isoformat(),
+    }
+
+
+def _current_user() -> AuthenticatedUser:
+    user: AuthenticatedUser | None = getattr(g, "current_user", None)
+    if user is None:
+        abort(401, description="not authenticated")
+    assert user is not None  # for Pyright; abort raises HTTPException
+    return user
+
+
+def _parse_uuid_or_400(raw: str) -> uuid.UUID | None:
+    try:
+        return uuid.UUID(raw)
+    except ValueError:
+        return None
+
+
+@bp.get("/<evidence_id>")
+@require_auth
+@require_perm("mission.read")
+def get_evidence(evidence_id: str):
+    """Metadata read. Use `?download=true` to receive the bytes inline.
+
+    The download mode streams the on-disk file via `send_file` with the
+    original filename in `Content-Disposition`. Browsers handle the
+    Content-Type guess from the stored mime.
+    """
+    eid = _parse_uuid_or_400(evidence_id)
+    if eid is None:
+        return jsonify({"error": "invalid_id"}), 400
+    user = _current_user()
+    want_download = request.args.get("download", "false").lower() == "true"
+
+    if want_download:
+        try:
+            view, path = svc.get_evidence_for_download(
+                eid, viewer_id=user.id, viewer_is_admin=user.is_admin
+            )
+        except svc.EvidenceNotFound:
+            return jsonify({"error": "not_found"}), 404
+        log.info(
+            "metamorph.evidence.download",
+            extra={
+                "evidence_id": str(eid),
+                "user_id": str(user.id),
+                "size_bytes": view.size_bytes,
+            },
+        )
+        return send_file(
+            str(path),
+            mimetype=view.mime,
+            as_attachment=True,
+            download_name=view.original_filename,
+            etag=view.sha256,
+            conditional=True,
+            max_age=0,
+        )
+
+    try:
+        view = svc.get_evidence(
+            eid, viewer_id=user.id, viewer_is_admin=user.is_admin
+        )
+    except svc.EvidenceNotFound:
+        return jsonify({"error": "not_found"}), 404
+    return jsonify(_serialize(view))
+
+
+@bp.delete("/<evidence_id>")
+@require_auth
+@require_perm("mission.write_blue_fields")
+def soft_delete_evidence(evidence_id: str):
+    eid = _parse_uuid_or_400(evidence_id)
+    if eid is None:
+        return jsonify({"error": "invalid_id"}), 400
+    user = _current_user()
+    try:
+        svc.soft_delete_evidence(
+            eid, viewer_id=user.id, viewer_is_admin=user.is_admin
+        )
+    except svc.EvidenceNotFound:
+        return jsonify({"error": "not_found"}), 404
+    return jsonify({"ok": True})