feat(tests,users): blocking procedure-suggestion review on test detail, multi-role switcher, Power Automate webhook payload

- A lead opening a test with a pending procedure suggestion awaiting
  their review now gets a blocking popup (approve/reject only) instead
  of discovering it later in a separate queue.
- Users can be granted more than one role via extra_roles; only one is
  ever active at a time (no permission mixing) and a top-bar switcher
  lets the user swap which one, taking effect immediately since role
  is read fresh from the DB on every request.
- The password-setup/reset webhook now posts the agreed Power Automate
  contract ({to, subject, body} with the platform's standard greeting
  and signature template) and supports an admin-configured API key
  sent as an x-api-key header.

backend/app/routers/users.py

@@ -28,6 +28,7 @@ from app.schemas.user import (
     UserPreferencesUpdate,
     UserOperatorOut,
     SendPasswordEmailOut,
+    SwitchRoleRequest,
 )
 from app.services.audit_service import log_action
 
@@ -36,6 +37,7 @@ from app.services.user_service import (
     create_user_without_password,
     get_user_or_raise,
     list_users,
+    switch_active_role,
     update_user,
 )
 from app.services.password_setup_service import send_password_setup_email
@@ -85,6 +87,39 @@ def get_me(
     return current_user
 
 
+# ---------------------------------------------------------------------------
+# POST /users/me/switch-role  —  swap the caller's active role
+# ---------------------------------------------------------------------------
+
+
+@router.post("/me/switch-role", response_model=UserOut)
+def switch_my_role(
+    payload: SwitchRoleRequest,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+) -> UserOut:
+    """Switch the caller's active role to one of their granted extra_roles.
+
+    Roles never mix — this changes which single role is active, it never
+    grants permissions from more than one role at once. Takes effect
+    immediately since every permission check reads ``role`` fresh from the
+    DB on each request.
+    """
+    with UnitOfWork(db) as uow:
+        user = switch_active_role(db, current_user, payload.role)
+        log_action(
+            db,
+            user_id=current_user.id,
+            action="switch_role",
+            entity_type="user",
+            entity_id=current_user.id,
+            details={"new_role": payload.role},
+        )
+        uow.commit()
+    db.refresh(user)
+    return user
+
+
 # ---------------------------------------------------------------------------
 # GET /users  —  list all users
 # ---------------------------------------------------------------------------