feat(backend): sprint 2 — simulations + MITRE ATT&CK

- Simulation model with full field set (redteam + SOC sides) and cascade delete
- Alembic migration 0002 for simulations table
- simulation_workflow service: PATCH RBAC field-level + auto-transition pending→in_progress + state machine
- mitre service: STIX bundle loader (boot-safe) + ranked search (exact-id > prefix-id > name)
- 7 new API endpoints: list/create/get/patch/delete simulations, transition, MITRE autocomplete
- serialize_simulation added to serializers.py
- Makefile update-mitre target with real curl + optional docker restart
- Dockerfile updated to copy backend/data/ into image
- MITRE enterprise-attack.json bundle committed (~45 MB)
- 67 new tests (total 130 passing), ruff clean, mypy introduces no new errors

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/test_simulations_workflow.py

@@ -0,0 +1,192 @@
+"""Simulation workflow / state machine tests."""
+from __future__ import annotations
+
+from flask.testing import FlaskClient
+
+from backend.tests.conftest import auth_headers as _h
+
+
+def _make_engagement(client: FlaskClient, token: str) -> dict:
+    resp = client.post(
+        "/api/engagements",
+        headers=_h(token),
+        json={"name": "Op Gamma", "start_date": "2026-06-01"},
+    )
+    assert resp.status_code == 201
+    return resp.get_json()
+
+
+def _make_sim(client: FlaskClient, token: str, eid: int) -> dict:
+    resp = client.post(
+        f"/api/engagements/{eid}/simulations",
+        headers=_h(token),
+        json={"name": "Workflow Sim"},
+    )
+    assert resp.status_code == 201
+    return resp.get_json()
+
+
+def _transition(client: FlaskClient, token: str, sid: int, to: str):
+    return client.post(
+        f"/api/simulations/{sid}/transition",
+        headers=_h(token),
+        json={"to": to},
+    )
+
+
+# ---------------------------------------------------------------------------
+# Valid transitions
+# ---------------------------------------------------------------------------
+
+
+def test_transition_to_review_required_from_pending(
+    client: FlaskClient, redteam_token: str
+) -> None:
+    eng = _make_engagement(client, redteam_token)
+    sim = _make_sim(client, redteam_token, eng["id"])
+    assert sim["status"] == "pending"
+
+    resp = _transition(client, redteam_token, sim["id"], "review_required")
+    assert resp.status_code == 200
+    assert resp.get_json()["status"] == "review_required"
+
+
+def test_transition_to_review_required_from_in_progress(
+    client: FlaskClient, redteam_token: str
+) -> None:
+    eng = _make_engagement(client, redteam_token)
+    sim = _make_sim(client, redteam_token, eng["id"])
+    # Auto-advance to in_progress
+    client.patch(
+        f"/api/simulations/{sim['id']}",
+        headers=_h(redteam_token),
+        json={"description": "started"},
+    )
+
+    resp = _transition(client, redteam_token, sim["id"], "review_required")
+    assert resp.status_code == 200
+    assert resp.get_json()["status"] == "review_required"
+
+
+def test_transition_to_done_by_redteam(
+    client: FlaskClient, redteam_token: str
+) -> None:
+    eng = _make_engagement(client, redteam_token)
+    sim = _make_sim(client, redteam_token, eng["id"])
+    _transition(client, redteam_token, sim["id"], "review_required")
+
+    resp = _transition(client, redteam_token, sim["id"], "done")
+    assert resp.status_code == 200
+    assert resp.get_json()["status"] == "done"
+
+
+def test_transition_to_done_by_soc(
+    client: FlaskClient, redteam_token: str, soc_token: str
+) -> None:
+    eng = _make_engagement(client, redteam_token)
+    sim = _make_sim(client, redteam_token, eng["id"])
+    _transition(client, redteam_token, sim["id"], "review_required")
+
+    resp = _transition(client, soc_token, sim["id"], "done")
+    assert resp.status_code == 200
+    assert resp.get_json()["status"] == "done"
+
+
+def test_transition_to_done_by_admin(
+    client: FlaskClient, admin_token: str
+) -> None:
+    eng = _make_engagement(client, admin_token)
+    sim = _make_sim(client, admin_token, eng["id"])
+    _transition(client, admin_token, sim["id"], "review_required")
+
+    resp = _transition(client, admin_token, sim["id"], "done")
+    assert resp.status_code == 200
+    assert resp.get_json()["status"] == "done"
+
+
+# ---------------------------------------------------------------------------
+# Invalid transitions (AC-11.3)
+# ---------------------------------------------------------------------------
+
+
+def test_transition_done_from_pending_rejected(
+    client: FlaskClient, redteam_token: str
+) -> None:
+    eng = _make_engagement(client, redteam_token)
+    sim = _make_sim(client, redteam_token, eng["id"])
+
+    resp = _transition(client, redteam_token, sim["id"], "done")
+    assert resp.status_code == 409
+
+
+def test_transition_to_pending_rejected(
+    client: FlaskClient, redteam_token: str
+) -> None:
+    eng = _make_engagement(client, redteam_token)
+    sim = _make_sim(client, redteam_token, eng["id"])
+    _transition(client, redteam_token, sim["id"], "review_required")
+
+    resp = _transition(client, redteam_token, sim["id"], "pending")
+    assert resp.status_code == 409
+
+
+def test_transition_to_in_progress_rejected(
+    client: FlaskClient, redteam_token: str
+) -> None:
+    eng = _make_engagement(client, redteam_token)
+    sim = _make_sim(client, redteam_token, eng["id"])
+
+    resp = _transition(client, redteam_token, sim["id"], "in_progress")
+    assert resp.status_code == 409
+
+
+def test_transition_unknown_status_rejected(
+    client: FlaskClient, redteam_token: str
+) -> None:
+    eng = _make_engagement(client, redteam_token)
+    sim = _make_sim(client, redteam_token, eng["id"])
+
+    resp = _transition(client, redteam_token, sim["id"], "nonexistent")
+    assert resp.status_code == 409
+
+
+def test_transition_review_required_from_done_rejected(
+    client: FlaskClient, redteam_token: str
+) -> None:
+    eng = _make_engagement(client, redteam_token)
+    sim = _make_sim(client, redteam_token, eng["id"])
+    _transition(client, redteam_token, sim["id"], "review_required")
+    _transition(client, redteam_token, sim["id"], "done")
+
+    resp = _transition(client, redteam_token, sim["id"], "review_required")
+    assert resp.status_code == 409
+
+
+# ---------------------------------------------------------------------------
+# RBAC by role
+# ---------------------------------------------------------------------------
+
+
+def test_soc_cannot_transition_to_review_required(
+    client: FlaskClient, redteam_token: str, soc_token: str
+) -> None:
+    eng = _make_engagement(client, redteam_token)
+    sim = _make_sim(client, redteam_token, eng["id"])
+
+    resp = _transition(client, soc_token, sim["id"], "review_required")
+    assert resp.status_code == 403
+
+
+def test_soc_cannot_transition_to_done_from_pending(
+    client: FlaskClient, redteam_token: str, soc_token: str
+) -> None:
+    eng = _make_engagement(client, redteam_token)
+    sim = _make_sim(client, redteam_token, eng["id"])
+
+    resp = _transition(client, soc_token, sim["id"], "done")
+    assert resp.status_code == 409
+
+
+def test_transition_simulation_404(client: FlaskClient, redteam_token: str) -> None:
+    resp = _transition(client, redteam_token, 9999, "review_required")
+    assert resp.status_code == 404