feat(tests,users): blocking procedure-suggestion review on test detail, multi-role switcher, Power Automate webhook payload

- A lead opening a test with a pending procedure suggestion awaiting
  their review now gets a blocking popup (approve/reject only) instead
  of discovering it later in a separate queue.
- Users can be granted more than one role via extra_roles; only one is
  ever active at a time (no permission mixing) and a top-bar switcher
  lets the user swap which one, taking effect immediately since role
  is read fresh from the DB on every request.
- The password-setup/reset webhook now posts the agreed Power Automate
  contract ({to, subject, body} with the platform's standard greeting
  and signature template) and supports an admin-configured API key
  sent as an x-api-key header.

frontend/src/context/AuthContext.tsx

@@ -12,6 +12,7 @@ import {
   getMe,
   refreshToken as apiRefreshToken,
 } from "../api/auth";
+import { switchRole as apiSwitchRole } from "../api/users";
 import type { User } from "../types/models";
 import ChangePasswordModal from "../components/ChangePasswordModal";
 
@@ -23,6 +24,10 @@ interface AuthState {
   isLoading: boolean;
   login: (username: string, password: string) => Promise<void>;
   logout: () => void;
+  /** Switch the active role to one of the user's granted extra_roles.
+   * Reloads the page afterward so every role-gated component (nav, route
+   * guards, etc.) re-evaluates cleanly against the new role. */
+  switchRole: (role: string) => Promise<void>;
 }
 
 const AuthContext = createContext<AuthState | undefined>(undefined);
@@ -72,6 +77,11 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     setUser(null);
   }, []);
 
+  const switchRole = useCallback(async (role: string) => {
+    await apiSwitchRole(role);
+    window.location.reload();
+  }, []);
+
   const mustChangePassword = user?.must_change_password === true;
 
   return (
@@ -82,6 +92,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
         isLoading,
         login,
         logout,
+        switchRole,
       }}
     >
       {children}