feat(tests,users): blocking procedure-suggestion review on test detail, multi-role switcher, Power Automate webhook payload

- A lead opening a test with a pending procedure suggestion awaiting
  their review now gets a blocking popup (approve/reject only) instead
  of discovering it later in a separate queue.
- Users can be granted more than one role via extra_roles; only one is
  ever active at a time (no permission mixing) and a top-bar switcher
  lets the user swap which one, taking effect immediately since role
  is read fresh from the DB on every request.
- The password-setup/reset webhook now posts the agreed Power Automate
  contract ({to, subject, body} with the platform's standard greeting
  and signature template) and supports an admin-configured API key
  sent as an x-api-key header.

backend/app/schemas/user.py

@@ -182,6 +182,8 @@ class UserUpdate(BaseModel):
     full_name: str | None = None
     # Assign role = None
     role: str | None = None
+    # Other roles this user can switch into via the top-bar switcher.
+    extra_roles: list[str] | None = None
     # Assign is_active = None
     is_active: bool | None = None
     # Assign password = None
@@ -265,6 +267,7 @@ class UserOut(BaseModel):
     email: str | None = None
     # role: str
     role: str
+    extra_roles: list[str] = Field(default_factory=list)
     # is_active: bool
     is_active: bool
     # Assign must_change_password = True
@@ -335,3 +338,11 @@ class SetPasswordRequest(BaseModel):
     @classmethod
     def new_password_strength(cls, v: str) -> str:
         return _validate_password_strength(v)
+
+
+# ── Multi-role switching ─────────────────────────────────────────────
+
+class SwitchRoleRequest(BaseModel):
+    """Payload for switching the caller's currently-active role."""
+
+    role: str