feat(tests,users): blocking procedure-suggestion review on test detail, multi-role switcher, Power Automate webhook payload

- A lead opening a test with a pending procedure suggestion awaiting
  their review now gets a blocking popup (approve/reject only) instead
  of discovering it later in a separate queue.
- Users can be granted more than one role via extra_roles; only one is
  ever active at a time (no permission mixing) and a top-bar switcher
  lets the user swap which one, taking effect immediately since role
  is read fresh from the DB on every request.
- The password-setup/reset webhook now posts the agreed Power Automate
  contract ({to, subject, body} with the platform's standard greeting
  and signature template) and supports an admin-configured API key
  sent as an x-api-key header.

backend/app/routers/procedure_suggestions.py

@@ -73,6 +73,25 @@ def list_suggestions(
     return [_to_out(s, template_by_id) for s in suggestions]
 
 
+@router.get("/for-test/{test_id}", response_model=list[ProcedureSuggestionOut])
+def list_suggestions_for_test(
+    test_id: uuid.UUID,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(require_any_role_strict("red_lead", "blue_lead", "admin")),
+) -> list[ProcedureSuggestionOut]:
+    """List pending suggestions tied to a specific test, scoped to the
+    caller's team (admins see both) — powers the blocking review popup a
+    lead sees when opening a test that has one awaiting them."""
+    team = _team_for_role(current_user)
+    suggestions = list_pending_suggestions(db, team=team, source_test_id=test_id)
+    template_ids = {s.template_id for s in suggestions}
+    templates = (
+        db.query(TestTemplate).filter(TestTemplate.id.in_(template_ids)).all() if template_ids else []
+    )
+    template_by_id = {t.id: t for t in templates}
+    return [_to_out(s, template_by_id) for s in suggestions]
+
+
 @router.post("/{suggestion_id}/approve", response_model=ProcedureSuggestionOut)
 def approve_suggestion(
     suggestion_id: uuid.UUID,