feat(tests,users): blocking procedure-suggestion review on test detail, multi-role switcher, Power Automate webhook payload

- A lead opening a test with a pending procedure suggestion awaiting
  their review now gets a blocking popup (approve/reject only) instead
  of discovering it later in a separate queue.
- Users can be granted more than one role via extra_roles; only one is
  ever active at a time (no permission mixing) and a top-bar switcher
  lets the user swap which one, taking effect immediately since role
  is read fresh from the DB on every request.
- The password-setup/reset webhook now posts the agreed Power Automate
  contract ({to, subject, body} with the platform's standard greeting
  and signature template) and supports an admin-configured API key
  sent as an x-api-key header.

backend/tests/test_procedure_suggestions.py

@@ -306,3 +306,67 @@ def test_detect_procedure_defaults_to_template_expected_detection(
     )
     assert resp.status_code == 201, resp.text
     assert resp.json()["detect_procedure"] == "Check process creation logs."
+
+
+class TestSuggestionsForTest:
+    """GET /procedure-suggestions/for-test/{test_id} — powers the blocking
+    review popup a lead sees when opening a test with a pending suggestion."""
+
+    def test_returns_pending_suggestion_for_the_right_test(
+        self, client, db, api, test_from_template, red_tech_headers, red_lead_headers,
+    ):
+        test_id = test_from_template
+        api("post", f"/api/v1/tests/{test_id}/start-execution", red_tech_headers)
+        api(
+            "patch", f"/api/v1/tests/{test_id}/red", red_tech_headers,
+            json={"procedure_text": "Ran discovery.\nwhoami /priv\nDone."},
+        )
+        _add_evidence(db, test_id, TeamSide.red)
+        api("post", f"/api/v1/tests/{test_id}/submit-red", red_tech_headers)
+
+        resp = api("get", f"/api/v1/procedure-suggestions/for-test/{test_id}", red_lead_headers)
+        assert resp.status_code == 200, resp.text
+        suggestions = resp.json()
+        assert len(suggestions) == 1
+        assert suggestions[0]["suggested_text"] == "whoami /priv"
+
+    def test_returns_empty_for_a_test_with_no_suggestion(
+        self, client, db, api, test_from_template, red_lead_headers,
+    ):
+        resp = api("get", f"/api/v1/procedure-suggestions/for-test/{test_from_template}", red_lead_headers)
+        assert resp.status_code == 200, resp.text
+        assert resp.json() == []
+
+    def test_blue_lead_does_not_see_a_red_suggestion_for_the_test(
+        self, client, db, api, test_from_template, red_tech_headers, blue_lead_headers,
+    ):
+        test_id = test_from_template
+        api("post", f"/api/v1/tests/{test_id}/start-execution", red_tech_headers)
+        api(
+            "patch", f"/api/v1/tests/{test_id}/red", red_tech_headers,
+            json={"procedure_text": "Ran discovery.\nwhoami /priv\nDone."},
+        )
+        _add_evidence(db, test_id, TeamSide.red)
+        api("post", f"/api/v1/tests/{test_id}/submit-red", red_tech_headers)
+
+        resp = api("get", f"/api/v1/procedure-suggestions/for-test/{test_id}", blue_lead_headers)
+        assert resp.status_code == 200, resp.text
+        assert resp.json() == []
+
+    def test_suggestion_disappears_from_for_test_once_approved(
+        self, client, db, api, test_from_template, red_tech_headers, red_lead_headers,
+    ):
+        test_id = test_from_template
+        api("post", f"/api/v1/tests/{test_id}/start-execution", red_tech_headers)
+        api(
+            "patch", f"/api/v1/tests/{test_id}/red", red_tech_headers,
+            json={"procedure_text": "Ran discovery.\nwhoami /priv\nDone."},
+        )
+        _add_evidence(db, test_id, TeamSide.red)
+        api("post", f"/api/v1/tests/{test_id}/submit-red", red_tech_headers)
+
+        suggestion = api("get", f"/api/v1/procedure-suggestions/for-test/{test_id}", red_lead_headers).json()[0]
+        api("post", f"/api/v1/procedure-suggestions/{suggestion['id']}/approve", red_lead_headers)
+
+        resp = api("get", f"/api/v1/procedure-suggestions/for-test/{test_id}", red_lead_headers)
+        assert resp.json() == []