feat(tests,users): blocking procedure-suggestion review on test detail, multi-role switcher, Power Automate webhook payload

- A lead opening a test with a pending procedure suggestion awaiting
  their review now gets a blocking popup (approve/reject only) instead
  of discovering it later in a separate queue.
- Users can be granted more than one role via extra_roles; only one is
  ever active at a time (no permission mixing) and a top-bar switcher
  lets the user swap which one, taking effect immediately since role
  is read fresh from the DB on every request.
- The password-setup/reset webhook now posts the agreed Power Automate
  contract ({to, subject, body} with the platform's standard greeting
  and signature template) and supports an admin-configured API key
  sent as an x-api-key header.

frontend/src/api/procedure-suggestions.ts

@@ -7,6 +7,13 @@ export async function getProcedureSuggestions(): Promise<ProcedureSuggestion[]>
   return data;
 }
 
+/** List pending suggestions tied to a specific test — powers the blocking
+ *  review popup a lead sees when opening a test that has one awaiting them. */
+export async function getProcedureSuggestionsForTest(testId: string): Promise<ProcedureSuggestion[]> {
+  const { data } = await client.get<ProcedureSuggestion[]>(`/procedure-suggestions/for-test/${testId}`);
+  return data;
+}
+
 /** Approve a suggestion — writes it into the template's suggested-procedure field. */
 export async function approveProcedureSuggestion(id: string): Promise<ProcedureSuggestion> {
   const { data } = await client.post<ProcedureSuggestion>(`/procedure-suggestions/${id}/approve`);

frontend/src/api/settings.ts

@@ -202,6 +202,7 @@ export async function testJiraConnection(): Promise<{
 export interface PasswordWebhookConfigOut {
   configured: boolean;
   url: string;
+  api_key_set: boolean;
 }
 
 export async function getPasswordWebhookConfig(): Promise<PasswordWebhookConfigOut> {
@@ -209,8 +210,15 @@ export async function getPasswordWebhookConfig(): Promise<PasswordWebhookConfigO
   return data;
 }
 
-export async function updatePasswordWebhookConfig(url: string): Promise<PasswordWebhookConfigOut> {
-  const { data } = await client.patch<PasswordWebhookConfigOut>("/system/password-webhook-config", { url });
+/** apiKey is optional — omit or pass "" to leave the currently-stored key unchanged. */
+export async function updatePasswordWebhookConfig(
+  url: string,
+  apiKey?: string,
+): Promise<PasswordWebhookConfigOut> {
+  const { data } = await client.patch<PasswordWebhookConfigOut>("/system/password-webhook-config", {
+    url,
+    api_key: apiKey || undefined,
+  });
   return data;
 }
 

frontend/src/api/users.ts

@@ -6,6 +6,7 @@ export interface UserOut {
   full_name: string | null;
   email: string | null;
   role: string;
+  extra_roles: string[];
   is_active: boolean;
   must_change_password: boolean;
   created_at: string | null;
@@ -22,6 +23,7 @@ export interface UserUpdatePayload {
   email?: string;
   full_name?: string;
   role?: string;
+  extra_roles?: string[];
   is_active?: boolean;
   // Not sent by the current UI — the set-password-email flow replaces
   // admin-set passwords — but still supported server-side.
@@ -64,3 +66,9 @@ export async function sendPasswordEmail(userId: string): Promise<{ detail: strin
   const { data } = await client.post<{ detail: string }>(`/users/${userId}/send-password-email`);
   return data;
 }
+
+/** Switch the current user's active role to one of their granted extra_roles. */
+export async function switchRole(role: string): Promise<UserOut> {
+  const { data } = await client.post<UserOut>("/users/me/switch-role", { role });
+  return data;
+}