Remove a member from a vault

Take away a member's role in a vault. The vault, its documents, and its extracted data are untouched. Only this person's access goes away.

Removing the last owner returns 400, so a vault cannot be left ownerless. A user who holds no role in the vault returns 404, so a mistyped id is visible instead of reading as success.

Callers can remove themselves by passing their own user_id, which needs vault membership rather than the owner role. Removing anyone else requires the owner role in the vault and the organization-level permission to manage vaults.

Requires a user-scoped API key (u:gcai_...). A vault is shared with named people, so an organization-scoped key has no identity to resolve vault access with.