feat(backend): sprint 4 — tactic_ids + done guard + engagement auto-status

- Simulation model: add tactic_ids JSON column (nullable=False, default=[])
- Migration 0004: ADD COLUMN tactic_ids (server_default='[]', no batch needed)
- mitre.py: add _TACTIC_IDS map, lookup_tactic(), get_tactic_name()
- simulation_workflow.py: done guard (409) before RBAC; SOC gate += tactic_ids;
  _resolve_tactic_ids() validates against hardcoded map; auto-transition += tactic_ids;
  transition done→review_required is Reopen (all 3 roles); _maybe_activate_engagement hook
- serializers.py: _enrich_tactics() → serialize_simulation adds tactics:[{id,name}]
- test_simulations_tactics.py: valid/invalid/dedup/SOC gate/auto-transition/no-bundle
- test_simulations_done_readonly.py: 409 all roles, Reopen all roles, invalid transitions, after-reopen ok
- test_engagement_lifecycle.py: planned→active on auto-transition, already active/closed unchanged, migration 0004 round-trip
- Updated test_simulations_patch.py + test_simulations_workflow.py for AC-18 behavior

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/test_simulations_workflow.py

@@ -150,16 +150,18 @@ def test_transition_unknown_status_rejected(
     assert resp.status_code == 409
 
 
-def test_transition_review_required_from_done_rejected(
+def test_transition_review_required_from_done_is_reopen(
     client: FlaskClient, redteam_token: str
 ) -> None:
+    """done → review_required is the Reopen path, now allowed (AC-18.2)."""
     eng = _make_engagement(client, redteam_token)
     sim = _make_sim(client, redteam_token, eng["id"])
     _transition(client, redteam_token, sim["id"], "review_required")
     _transition(client, redteam_token, sim["id"], "done")
 
     resp = _transition(client, redteam_token, sim["id"], "review_required")
-    assert resp.status_code == 409
+    assert resp.status_code == 200
+    assert resp.get_json()["status"] == "review_required"
 
 
 # ---------------------------------------------------------------------------