feat(tests,users): blocking procedure-suggestion review on test detail, multi-role switcher, Power Automate webhook payload

- A lead opening a test with a pending procedure suggestion awaiting
  their review now gets a blocking popup (approve/reject only) instead
  of discovering it later in a separate queue.
- Users can be granted more than one role via extra_roles; only one is
  ever active at a time (no permission mixing) and a top-bar switcher
  lets the user swap which one, taking effect immediately since role
  is read fresh from the DB on every request.
- The password-setup/reset webhook now posts the agreed Power Automate
  contract ({to, subject, body} with the platform's standard greeting
  and signature template) and supports an admin-configured API key
  sent as an x-api-key header.

backend/tests/test_password_setup_flow.py

@@ -36,6 +36,29 @@ def test_admin_can_configure_password_webhook(api, auth_headers):
     assert get_resp.json()["url"] == "https://example.com/power-automate-hook"
 
 
+def test_admin_can_configure_webhook_api_key(api, auth_headers):
+    resp = api(
+        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        json={"url": "https://example.com/power-automate-hook", "api_key": "super-secret-key"},
+    )
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["api_key_set"] is True
+    # The key itself is never echoed back.
+    assert "api_key" not in resp.json()
+    assert "super-secret-key" not in resp.text
+
+
+def test_send_password_email_sends_api_key_header(api, db, auth_headers, new_user_id):
+    api(
+        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        json={"url": "https://example.com/power-automate-hook", "api_key": "super-secret-key"},
+    )
+    with patch("app.services.password_setup_service.requests.post") as mock_post:
+        api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
+    call_kwargs = mock_post.call_args
+    assert call_kwargs.kwargs["headers"] == {"x-api-key": "super-secret-key"}
+
+
 def test_send_password_email_posts_to_webhook_and_issues_token(api, db, auth_headers, new_user_id):
     api(
         "patch", "/api/v1/system/password-webhook-config", auth_headers,
@@ -48,8 +71,12 @@ def test_send_password_email_posts_to_webhook_and_issues_token(api, db, auth_hea
     mock_post.assert_called_once()
     call_kwargs = mock_post.call_args
     assert call_kwargs.args[0] == "https://example.com/power-automate-hook"
-    assert call_kwargs.kwargs["json"]["email"] == "setpw@test.com"
-    assert "token=" in call_kwargs.kwargs["json"]["set_password_url"]
+    payload = call_kwargs.kwargs["json"]
+    assert payload["to"] == "setpw@test.com"
+    assert payload["subject"] == "Set Your Password"
+    assert "HI Set Password User" in payload["body"]
+    assert "token=" in payload["body"]
+    assert "Purple Team Engineering" in payload["body"]
 
     from app.models.password_setup_token import PasswordSetupToken
     token_row = db.query(PasswordSetupToken).filter(PasswordSetupToken.user_id == uuid.UUID(new_user_id)).first()