feat(tests,users): blocking procedure-suggestion review on test detail, multi-role switcher, Power Automate webhook payload

- A lead opening a test with a pending procedure suggestion awaiting
  their review now gets a blocking popup (approve/reject only) instead
  of discovering it later in a separate queue.
- Users can be granted more than one role via extra_roles; only one is
  ever active at a time (no permission mixing) and a top-bar switcher
  lets the user swap which one, taking effect immediately since role
  is read fresh from the DB on every request.
- The password-setup/reset webhook now posts the agreed Power Automate
  contract ({to, subject, body} with the platform's standard greeting
  and signature template) and supports an admin-configured API key
  sent as an x-api-key header.

backend/app/services/procedure_suggestion_service.py

@@ -131,11 +131,17 @@ def create_suggestion_from_submission(db: Session, test: Test, team: str) -> Pro
     return suggestion
 
 
-def list_pending_suggestions(db: Session, *, team: str | None = None) -> list[ProcedureSuggestion]:
-    """List pending suggestions, optionally filtered to one team."""
+def list_pending_suggestions(
+    db: Session, *, team: str | None = None, source_test_id: uuid.UUID | None = None,
+) -> list[ProcedureSuggestion]:
+    """List pending suggestions, optionally filtered to one team and/or the
+    specific test that originated them (used to block a lead's test-detail
+    view on a suggestion awaiting their review)."""
     query = db.query(ProcedureSuggestion).filter(ProcedureSuggestion.status == "pending")
     if team is not None:
         query = query.filter(ProcedureSuggestion.team == team)
+    if source_test_id is not None:
+        query = query.filter(ProcedureSuggestion.source_test_id == source_test_id)
     return query.order_by(ProcedureSuggestion.created_at.asc()).all()