feat(tests,users): blocking procedure-suggestion review on test detail, multi-role switcher, Power Automate webhook payload

- A lead opening a test with a pending procedure suggestion awaiting
  their review now gets a blocking popup (approve/reject only) instead
  of discovering it later in a separate queue.
- Users can be granted more than one role via extra_roles; only one is
  ever active at a time (no permission mixing) and a top-bar switcher
  lets the user swap which one, taking effect immediately since role
  is read fresh from the DB on every request.
- The password-setup/reset webhook now posts the agreed Power Automate
  contract ({to, subject, body} with the platform's standard greeting
  and signature template) and supports an admin-configured API key
  sent as an x-api-key header.

frontend/src/api/procedure-suggestions.ts

@@ -7,6 +7,13 @@ export async function getProcedureSuggestions(): Promise<ProcedureSuggestion[]>
   return data;
 }
 
+/** List pending suggestions tied to a specific test — powers the blocking
+ *  review popup a lead sees when opening a test that has one awaiting them. */
+export async function getProcedureSuggestionsForTest(testId: string): Promise<ProcedureSuggestion[]> {
+  const { data } = await client.get<ProcedureSuggestion[]>(`/procedure-suggestions/for-test/${testId}`);
+  return data;
+}
+
 /** Approve a suggestion — writes it into the template's suggested-procedure field. */
 export async function approveProcedureSuggestion(id: string): Promise<ProcedureSuggestion> {
   const { data } = await client.post<ProcedureSuggestion>(`/procedure-suggestions/${id}/approve`);