fix(backend): post-review fixes sprint 2

- test_simulations_patch: remove false dict return annotation on _patch helper
- simulation_workflow: validate executed_at upfront before any setattr (prevents partial mutation on bad payload)
- api/simulations: remove unreachable role check in update_simulation (all valid roles are admin/redteam/soc)
- Dockerfile: remove redundant COPY backend/data/ (already covered by COPY backend/)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/api/simulations.py

@@ -80,9 +80,6 @@ def update_simulation(sid: int):
         return jsonify({"error": "Simulation not found"}), 404
 
     user = g.current_user
-    if user.role.value not in ("admin", "redteam", "soc"):
-        return jsonify({"error": "Forbidden"}), 403
-
     data = request.get_json(silent=True) or {}
     if not data:
         return jsonify(serialize_simulation(sim)), 200