feat(backend): sprint 4 — tactic_ids + done guard + engagement auto-status

- Simulation model: add tactic_ids JSON column (nullable=False, default=[])
- Migration 0004: ADD COLUMN tactic_ids (server_default='[]', no batch needed)
- mitre.py: add _TACTIC_IDS map, lookup_tactic(), get_tactic_name()
- simulation_workflow.py: done guard (409) before RBAC; SOC gate += tactic_ids;
  _resolve_tactic_ids() validates against hardcoded map; auto-transition += tactic_ids;
  transition done→review_required is Reopen (all 3 roles); _maybe_activate_engagement hook
- serializers.py: _enrich_tactics() → serialize_simulation adds tactics:[{id,name}]
- test_simulations_tactics.py: valid/invalid/dedup/SOC gate/auto-transition/no-bundle
- test_simulations_done_readonly.py: 409 all roles, Reopen all roles, invalid transitions, after-reopen ok
- test_engagement_lifecycle.py: planned→active on auto-transition, already active/closed unchanged, migration 0004 round-trip
- Updated test_simulations_patch.py + test_simulations_workflow.py for AC-18 behavior

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/serializers.py

@@ -30,12 +30,27 @@ def _enrich_techniques(raw: list[dict[str, Any]]) -> list[dict[str, Any]]:
     ]
 
 
+def _enrich_tactics(tactic_ids: list[str]) -> list[dict[str, str]]:
+    """Resolve TA-ids to {id, name} at runtime."""
+    from backend.app.services import mitre as mitre_svc
+
+    result = []
+    for tid in tactic_ids or []:
+        entry = mitre_svc.lookup_tactic(tid)
+        if entry is not None:
+            result.append(entry)
+        else:
+            result.append({"id": tid, "name": ""})
+    return result
+
+
 def serialize_simulation(simulation: Simulation) -> dict[str, Any]:
     return {
         "id": simulation.id,
         "engagement_id": simulation.engagement_id,
         "name": simulation.name,
         "techniques": _enrich_techniques(simulation.techniques or []),
+        "tactics": _enrich_tactics(simulation.tactic_ids or []),
         "description": simulation.description,
         "commands": simulation.commands,
         "prerequisites": simulation.prerequisites,