feat(backend): c2 callbacks + execute endpoints (sprint 8 M2)

- Add C2Error exception to adapter ABC
- Add promote_to_in_progress() helper to simulation_workflow (pending→in_progress)
- Flesh out MythicAdapter: list_callbacks() (GraphQL query) + create_task() (mutation)
- Expand FakeAdapter to 3 deterministic callbacks; switch task store to per-instance
- Add GET /api/engagements/<id>/c2/callbacks — lists active callbacks via adapter
- Add POST /api/simulations/<id>/c2/execute — issues tasks, stores C2Task rows,
  auto-transitions pending→in_progress, blocks on done (409)
- Both endpoints: SOC=403, 503 no-key, 502 adapter error, sanitized error messages
- Add requests-mock==1.12.1 to requirements.txt
- 42 new tests (342 total, 300 M1 baseline preserved green)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/services/c2/mythic.py

@@ -1,12 +1,14 @@
 # Contract pinned from MythicMeta/Mythic_Scripting master @ 2026-06-10 (raw.githubusercontent.com/MythicMeta/Mythic_Scripting/master/mythic/mythic.py)
 """Mythic 3.x C2 adapter.
 
-M1 implements test_connection() only.
-All other methods raise NotImplementedError("M2") — they land in milestone M2/M3.
-
 Transport: POST https://<host>:7443/graphql
 Header: apitoken: <token>
 Backend: Hasura-proxied Postgres behind nginx.
+
+M1: test_connection()
+M2: list_callbacks(), create_task()
+M3: get_task(), get_task_output()
+M4: list_callback_tasks()
 """
 from __future__ import annotations
 
@@ -15,12 +17,42 @@ import requests
 from backend.app.services.c2.adapter import (
     C2Adapter,
     C2Callback,
+    C2Error,
     C2Health,
     C2TaskPage,
     C2TaskStatus,
 )
 
-_HEALTH_QUERY = '{ __typename }'
+_HEALTH_QUERY = "{ __typename }"
+
+_CALLBACKS_QUERY = """
+query {
+  callback(order_by: {id: asc}, where: {active: {_eq: true}}) {
+    id
+    display_id
+    active
+    host
+    user
+    domain
+    last_checkin
+  }
+}
+"""
+
+_CREATE_TASK_MUTATION = """
+mutation CreateTask($callback_id: Int!, $command: String!, $params: String!) {
+  createTask(
+    callback_id: $callback_id,
+    command: $command,
+    params: $params,
+    tasking_location: "command_line"
+  ) {
+    id
+    display_id
+    error
+  }
+}
+"""
 
 
 class MythicAdapter(C2Adapter):
@@ -37,6 +69,18 @@ class MythicAdapter(C2Adapter):
             "apitoken": self._token,
         }
 
+    def _post(self, body: dict) -> dict:
+        resp = requests.post(
+            self._url,
+            json=body,
+            headers=self._headers(),
+            verify=self._verify,
+            timeout=10,
+            allow_redirects=False,
+        )
+        resp.raise_for_status()
+        return resp.json()
+
     def test_connection(self) -> C2Health:
         """POST a trivial introspection query to verify reachability and token validity."""
         try:
@@ -46,6 +90,7 @@ class MythicAdapter(C2Adapter):
                 headers=self._headers(),
                 verify=self._verify,
                 timeout=10,
+                allow_redirects=False,
             )
             if resp.status_code == 200:
                 return C2Health(ok=True)
@@ -54,7 +99,24 @@ class MythicAdapter(C2Adapter):
             return C2Health(ok=False, error=str(exc))
 
     def list_callbacks(self) -> list[C2Callback]:
-        raise NotImplementedError("M2")
+        """Return active callbacks from Mythic (filtered server-side: active=true)."""
+        try:
+            data = self._post({"query": _CALLBACKS_QUERY})
+        except requests.RequestException as exc:
+            raise C2Error(str(exc)) from exc
+
+        callbacks_raw = data.get("data", {}).get("callback", [])
+        return [
+            C2Callback(
+                display_id=cb["display_id"],
+                active=cb["active"],
+                host=cb.get("host") or "",
+                user=cb.get("user") or "",
+                domain=cb.get("domain") or "",
+                last_checkin=cb.get("last_checkin") or "",
+            )
+            for cb in callbacks_raw
+        ]
 
     def create_task(
         self,
@@ -62,10 +124,27 @@ class MythicAdapter(C2Adapter):
         command: str,
         params: str | None = None,
     ) -> int:
-        raise NotImplementedError("M2")
+        """Issue a task on a callback; return Mythic task display_id."""
+        try:
+            data = self._post({
+                "query": _CREATE_TASK_MUTATION,
+                "variables": {
+                    "callback_id": callback_display_id,
+                    "command": command,
+                    "params": params or "",
+                },
+            })
+        except requests.RequestException as exc:
+            raise C2Error(str(exc)) from exc
+
+        task_data = data.get("data", {}).get("createTask", {})
+        error_msg = task_data.get("error")
+        if error_msg:
+            raise C2Error(error_msg)
+        return int(task_data["display_id"])
 
     def get_task(self, task_display_id: int) -> C2TaskStatus:
-        raise NotImplementedError("M2")
+        raise NotImplementedError("M3")
 
     def get_task_output(self, task_display_id: int) -> str:
         raise NotImplementedError("M3")