feat(backend): sprint 2 — simulations + MITRE ATT&CK

- Simulation model with full field set (redteam + SOC sides) and cascade delete
- Alembic migration 0002 for simulations table
- simulation_workflow service: PATCH RBAC field-level + auto-transition pending→in_progress + state machine
- mitre service: STIX bundle loader (boot-safe) + ranked search (exact-id > prefix-id > name)
- 7 new API endpoints: list/create/get/patch/delete simulations, transition, MITRE autocomplete
- serialize_simulation added to serializers.py
- Makefile update-mitre target with real curl + optional docker restart
- Dockerfile updated to copy backend/data/ into image
- MITRE enterprise-attack.json bundle committed (~45 MB)
- 67 new tests (total 130 passing), ruff clean, mypy introduces no new errors

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/models/__init__.py

@@ -1,5 +1,6 @@
 """SQLAlchemy models."""
 from backend.app.models.engagement import Engagement, EngagementStatus
+from backend.app.models.simulation import Simulation, SimulationStatus
 from backend.app.models.user import User, UserRole
 
-__all__ = ["User", "UserRole", "Engagement", "EngagementStatus"]
+__all__ = ["User", "UserRole", "Engagement", "EngagementStatus", "Simulation", "SimulationStatus"]

backend/app/models/simulation.py

@@ -0,0 +1,62 @@
+"""Simulation model."""
+from __future__ import annotations
+
+import enum
+from datetime import UTC, datetime
+
+from backend.app.extensions import db
+
+
+class SimulationStatus(str, enum.Enum):
+    PENDING = "pending"
+    IN_PROGRESS = "in_progress"
+    REVIEW_REQUIRED = "review_required"
+    DONE = "done"
+
+
+class Simulation(db.Model):  # type: ignore[name-defined]
+    __tablename__ = "simulations"
+
+    id = db.Column(db.Integer, primary_key=True)
+    engagement_id = db.Column(
+        db.Integer,
+        db.ForeignKey("engagements.id", ondelete="CASCADE"),
+        nullable=False,
+        index=True,
+    )
+    name = db.Column(db.String(255), nullable=False)
+    mitre_technique_id = db.Column(db.String(32), nullable=True)
+    mitre_technique_name = db.Column(db.String(255), nullable=True)
+    description = db.Column(db.Text, nullable=True)
+    commands = db.Column(db.Text, nullable=True)
+    prerequisites = db.Column(db.Text, nullable=True)
+    executed_at = db.Column(db.DateTime, nullable=True)
+    execution_result = db.Column(db.Text, nullable=True)
+    log_source = db.Column(db.Text, nullable=True)
+    logs = db.Column(db.Text, nullable=True)
+    soc_comment = db.Column(db.Text, nullable=True)
+    incident_number = db.Column(db.String(128), nullable=True)
+    status = db.Column(
+        db.Enum(SimulationStatus, name="simulation_status"),
+        nullable=False,
+        default=SimulationStatus.PENDING,
+    )
+    created_at = db.Column(
+        db.DateTime, nullable=False, default=lambda: datetime.now(UTC)
+    )
+    updated_at = db.Column(db.DateTime, nullable=True)
+    created_by_id = db.Column(
+        db.Integer,
+        db.ForeignKey("users.id", ondelete="RESTRICT"),
+        nullable=False,
+        index=True,
+    )
+
+    engagement = db.relationship(
+        "Engagement",
+        backref=db.backref("simulations", cascade="all, delete-orphan", lazy="dynamic"),
+    )
+    created_by = db.relationship("User", backref="simulations", lazy="joined")
+
+    def __repr__(self) -> str:
+        return f"<Simulation {self.id} {self.name!r}>"