DEV: add expert assignment analytics and evaluation drilldown

[TThanos3000]

Summary

• Correct assignment completion: a submitted project and scores for every current-program criterion are required; zero criteria never means completed.
• Preserve evaluation_status.assignments.total/pending/evaluated and the invariant total = pending + evaluated. Distributed project status now counts completed assignments; open project evaluation keeps its existing any-score behavior.
• Add manager-only read-only assignment list and score drilldown, with explicit safe expert fields and no private user data.
• Add waiting time from the later of submission/assignment and delayed expert SLA (2 assignments >=24h or 1 >=48h); no synthetic assignments or open-mode delays.
• Extend the existing analytics documentation with exact contracts, legacy timestamp behavior and query budgets.

API

• GET /programs/<program_id>/manager-overview/assignments/?scope=all|completed|pending
• GET /programs/<program_id>/manager-overview/assignments/<assignment_id>/scores/
• Existing overview adds attention.delayed_experts without removing existing fields.
• Both endpoints use the same can_manage_program access as overview: manager/staff/superuser only. Anonymous 401, other authenticated users (including expert-only) 403; foreign-program assignment 404. Invalid/empty scope 400; write methods 405.
• Statuses: not_ready, pending, in_progress, completed. All current-program criteria count, including the existing automatically created Comment criterion.
• Scores include every current-program criterion, preserving string/null values and distinguishing missing rows with is_scored.

Audit / implementation

The previous _get_assignment_metrics used Exists(ProjectScore); one score completed an assignment. Now a shared read-only service uses DISTINCT current-program criteria for the assigned expert user and project. No model, signal, score writing or project submission changes.

Waiting is max(project submission timestamp, assignment creation timestamp). Missing legacy submission timestamps produce null waiting and no invented SLA delay. Completed/not-ready assignments have null waiting.

One assignment SELECT with JOINs and subqueries supplies user/project data and progress. Overview reuses it for project metrics and SLA. Query regression from 1 to 31 assignments: list 3 SQL, overview 10 SQL, scores 5 SQL (pre-authenticated manager; auth may add its own queries).

Verification

• Targeted manager analytics + project_rates: 69 tests passed locally (SQLite).
• Black on all 7 changed Python files: passed.
• Flake8 on changed files: passed.
• Django check and check --tag models: passed.
• makemigrations --check --dry-run: no changes detected.
• git diff --check: passed.
• GitHub Tests: passed, 613 tests discovered, 612 passed / 1 PostgreSQL-only skip.
• GitHub Lint: passed, repository-wide.
• GitHub Backend PostgreSQL CI: passed, full 613/613 plus 39/39 targeted locking/vacancy tests. PostgreSQL vendor and select_for_update assertions, Django/model checks, migration consistency and migrations on an empty database all passed.
• Full local Windows suite: 613 tests, 611 passed / 1 skipped / 1 failure in unchanged feed.tests.test_feed_api.FeedAPITests.test_feed_returns_project_news_as_news_content; the same intermittent failure was reproduced in a clean detached worktree at base SHA 95009d41731c740b12e6839199cfb9de2338655c (single run passed, repeated run failed). No feed changes were made. SQLite teardown also encountered Windows file locking. Both authoritative Linux full-suite runs above are green.

Local Windows caveat: native Pango is unavailable, so local Django tests/checks use the pre-existing external WeasyPrint import stub; no application or test-runner code changed. Linux CI uses real WeasyPrint. Repository-wide local flake8 5 on Python 3.12 reports pre-existing f-string tokenization errors in unchanged files; the standard GitHub lint job uses Python 3.11.

Scope

Backend analytics only, based on dev 95009d41731c740b12e6839199cfb9de2338655c.
No migrations/models, Angular, React, auth/profile/region/vacancy behavior, notifications, API scoring changes, workflows, Docker or deploy changes.

Draft. Do not merge or deploy.