feat(backend): sprint 4 — tactic_ids + done guard + engagement auto-status

- Simulation model: add tactic_ids JSON column (nullable=False, default=[])
- Migration 0004: ADD COLUMN tactic_ids (server_default='[]', no batch needed)
- mitre.py: add _TACTIC_IDS map, lookup_tactic(), get_tactic_name()
- simulation_workflow.py: done guard (409) before RBAC; SOC gate += tactic_ids;
  _resolve_tactic_ids() validates against hardcoded map; auto-transition += tactic_ids;
  transition done→review_required is Reopen (all 3 roles); _maybe_activate_engagement hook
- serializers.py: _enrich_tactics() → serialize_simulation adds tactics:[{id,name}]
- test_simulations_tactics.py: valid/invalid/dedup/SOC gate/auto-transition/no-bundle
- test_simulations_done_readonly.py: 409 all roles, Reopen all roles, invalid transitions, after-reopen ok
- test_engagement_lifecycle.py: planned→active on auto-transition, already active/closed unchanged, migration 0004 round-trip
- Updated test_simulations_patch.py + test_simulations_workflow.py for AC-18 behavior

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/services/mitre.py

@@ -26,6 +26,22 @@ _TACTIC_ORDER = [
     "impact",
 ]
 
+# TA-id → short-name mapping (MITRE Enterprise, IDs are not sequential).
+_TACTIC_IDS: dict[str, str] = {
+    "TA0001": "initial-access",
+    "TA0002": "execution",
+    "TA0003": "persistence",
+    "TA0004": "privilege-escalation",
+    "TA0005": "defense-evasion",
+    "TA0006": "credential-access",
+    "TA0007": "discovery",
+    "TA0008": "lateral-movement",
+    "TA0009": "collection",
+    "TA0011": "command-and-control",
+    "TA0010": "exfiltration",
+    "TA0040": "impact",
+}
+
 TACTIC_NAMES: dict[str, str] = {
     "initial-access": "Initial Access",
     "execution": "Execution",
@@ -181,6 +197,22 @@ def get_matrix() -> list[dict[str, Any]]:
     return _matrix
 
 
+def lookup_tactic(tactic_id: str) -> dict[str, str] | None:
+    """Return {id, name} for a TA-id, or None if unknown."""
+    short = _TACTIC_IDS.get(tactic_id)
+    if short is None:
+        return None
+    return {"id": tactic_id, "name": TACTIC_NAMES[short]}
+
+
+def get_tactic_name(tactic_id: str) -> str | None:
+    """Return the display name for a TA-id, or None if unknown."""
+    short = _TACTIC_IDS.get(tactic_id)
+    if short is None:
+        return None
+    return TACTIC_NAMES[short]
+
+
 def search(query: str, limit: int = 20) -> list[dict[str, Any]]:
     """Return up to `limit` techniques matching `query`.