feat(tests,users): blocking procedure-suggestion review on test detail, multi-role switcher, Power Automate webhook payload

- A lead opening a test with a pending procedure suggestion awaiting
  their review now gets a blocking popup (approve/reject only) instead
  of discovering it later in a separate queue.
- Users can be granted more than one role via extra_roles; only one is
  ever active at a time (no permission mixing) and a top-bar switcher
  lets the user swap which one, taking effect immediately since role
  is read fresh from the DB on every request.
- The password-setup/reset webhook now posts the agreed Power Automate
  contract ({to, subject, body} with the platform's standard greeting
  and signature template) and supports an admin-configured API key
  sent as an x-api-key header.

backend/app/routers/system.py

@@ -347,10 +347,13 @@ def update_jira_config(
 class PasswordWebhookConfigOut(BaseModel):
     configured: bool
     url: str
+    api_key_set: bool
 
 
 class PasswordWebhookConfigUpdate(BaseModel):
     url: str
+    # Optional — omit or send "" to leave the currently-stored key unchanged.
+    api_key: Optional[str] = None
 
 
 @router.get("/password-webhook-config", response_model=PasswordWebhookConfigOut)
@@ -360,12 +363,15 @@ def get_password_webhook_config(
 ):
     """Return the configured webhook URL used to email set-password links.
 
+    The API key itself is never returned, only whether one is set.
+
     **Requires** the ``admin`` role.
     """
-    from app.services.password_setup_service import get_password_webhook_url
+    from app.services.password_setup_service import get_password_webhook_api_key, get_password_webhook_url
 
     url = get_password_webhook_url(db) or ""
-    return PasswordWebhookConfigOut(configured=bool(url), url=url)
+    api_key_set = bool(get_password_webhook_api_key(db))
+    return PasswordWebhookConfigOut(configured=bool(url), url=url, api_key_set=api_key_set)
 
 
 @router.patch("/password-webhook-config", response_model=PasswordWebhookConfigOut)
@@ -374,16 +380,24 @@ def update_password_webhook_config(
     db: Session = Depends(get_db),
     current_user: User = Depends(require_role("admin")),
 ):
-    """Set the webhook URL used to email set-password links.
+    """Set the webhook URL (and optionally API key) used to email set-password links.
 
     **Requires** the ``admin`` role.
     """
-    from app.services.password_setup_service import get_password_webhook_url, set_password_webhook_url
+    from app.services.password_setup_service import (
+        get_password_webhook_api_key,
+        get_password_webhook_url,
+        set_password_webhook_api_key,
+        set_password_webhook_url,
+    )
 
     set_password_webhook_url(db, payload.url)
+    if payload.api_key:
+        set_password_webhook_api_key(db, payload.api_key)
     db.commit()
     url = get_password_webhook_url(db) or ""
-    return PasswordWebhookConfigOut(configured=bool(url), url=url)
+    api_key_set = bool(get_password_webhook_api_key(db))
+    return PasswordWebhookConfigOut(configured=bool(url), url=url, api_key_set=api_key_set)
 
 
 @router.post("/jira-test")