feat(backend): c2 callbacks + execute endpoints (sprint 8 M2)

- Add C2Error exception to adapter ABC
- Add promote_to_in_progress() helper to simulation_workflow (pending→in_progress)
- Flesh out MythicAdapter: list_callbacks() (GraphQL query) + create_task() (mutation)
- Expand FakeAdapter to 3 deterministic callbacks; switch task store to per-instance
- Add GET /api/engagements/<id>/c2/callbacks — lists active callbacks via adapter
- Add POST /api/simulations/<id>/c2/execute — issues tasks, stores C2Task rows,
  auto-transitions pending→in_progress, blocks on done (409)
- Both endpoints: SOC=403, 503 no-key, 502 adapter error, sanitized error messages
- Add requests-mock==1.12.1 to requirements.txt
- 42 new tests (342 total, 300 M1 baseline preserved green)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/test_c2_config.py

@@ -95,6 +95,21 @@ def test_get_config_engagement_not_found(client: FlaskClient, admin_token: str)
 # ---------------------------------------------------------------------------
 
 
+def test_put_rejects_http_scheme(client: FlaskClient, admin_token: str) -> None:
+    eng = _make_engagement(client, admin_token)
+    resp = _put_config(client, admin_token, eng["id"], url="http://c2.internal:7443")
+    assert resp.status_code == 400
+    assert "https" in resp.get_json().get("error", "").lower()
+
+
+def test_put_rejects_missing_hostname(client: FlaskClient, admin_token: str) -> None:
+    eng = _make_engagement(client, admin_token)
+    # urlparse("https://:7443") produces an empty hostname
+    resp = _put_config(client, admin_token, eng["id"], url="https://:7443")
+    assert resp.status_code == 400
+    assert "hostname" in resp.get_json().get("error", "").lower()
+
+
 def test_put_creates_config(client: FlaskClient, admin_token: str) -> None:
     eng = _make_engagement(client, admin_token)
     resp = _put_config(client, admin_token, eng["id"])