feat(tests,users): blocking procedure-suggestion review on test detail, multi-role switcher, Power Automate webhook payload

- A lead opening a test with a pending procedure suggestion awaiting
  their review now gets a blocking popup (approve/reject only) instead
  of discovering it later in a separate queue.
- Users can be granted more than one role via extra_roles; only one is
  ever active at a time (no permission mixing) and a top-bar switcher
  lets the user swap which one, taking effect immediately since role
  is read fresh from the DB on every request.
- The password-setup/reset webhook now posts the agreed Power Automate
  contract ({to, subject, body} with the platform's standard greeting
  and signature template) and supports an admin-configured API key
  sent as an x-api-key header.

backend/alembic/versions/b066_user_extra_roles.py

@@ -0,0 +1,32 @@
+"""Add users.extra_roles for multi-role support.
+
+A user can be granted more than one role, but only ever acts under a
+single "active" role at a time (``users.role``, unchanged — every
+existing permission check keeps reading it as-is). ``extra_roles`` holds
+the *other* roles a user can switch into via the top-bar role switcher;
+switching swaps the active role with one from this list.
+
+Revision ID: b066
+Revises: b065
+Create Date: 2026-07-20
+"""
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import postgresql
+
+revision = "b066"
+down_revision = "b065"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "users",
+        sa.Column("extra_roles", postgresql.JSONB(), nullable=False, server_default="[]"),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("users", "extra_roles")