feat(backend): sprint 4 — tactic_ids + done guard + engagement auto-status

- Simulation model: add tactic_ids JSON column (nullable=False, default=[])
- Migration 0004: ADD COLUMN tactic_ids (server_default='[]', no batch needed)
- mitre.py: add _TACTIC_IDS map, lookup_tactic(), get_tactic_name()
- simulation_workflow.py: done guard (409) before RBAC; SOC gate += tactic_ids;
  _resolve_tactic_ids() validates against hardcoded map; auto-transition += tactic_ids;
  transition done→review_required is Reopen (all 3 roles); _maybe_activate_engagement hook
- serializers.py: _enrich_tactics() → serialize_simulation adds tactics:[{id,name}]
- test_simulations_tactics.py: valid/invalid/dedup/SOC gate/auto-transition/no-bundle
- test_simulations_done_readonly.py: 409 all roles, Reopen all roles, invalid transitions, after-reopen ok
- test_engagement_lifecycle.py: planned→active on auto-transition, already active/closed unchanged, migration 0004 round-trip
- Updated test_simulations_patch.py + test_simulations_workflow.py for AC-18 behavior

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/migrations/versions/0004_simulation_tactic_ids.py

@@ -0,0 +1,33 @@
+"""add tactic_ids JSON column to simulations
+
+Revision ID: 0004
+Revises: 0003
+Create Date: 2026-05-27 00:00:00.000000
+"""
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.sql import text
+
+revision = "0004"
+down_revision = "0003"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # ADD COLUMN is safe on SQLite without batch mode.
+    # server_default='[]' satisfies NOT NULL for existing rows.
+    op.add_column(
+        "simulations",
+        sa.Column(
+            "tactic_ids",
+            sa.JSON(),
+            nullable=False,
+            server_default=text("'[]'"),
+        ),
+    )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("simulations") as batch_op:
+        batch_op.drop_column("tactic_ids")