Remove a team member

Owner-only — a member gets 403, including a member trying to remove another member. Soft-deletes the user and immediately invalidates every session they are logged in with — a browser tab already open under that account stops working on its next request, not merely on its next login. The account owner cannot be removed through this endpoint (400), and neither can you remove yourself (400) — leave the account or transfer ownership instead.