Apply User Role Change

Move a user's role attachments: add company roles, remove (typically global) roles.

DB-only by design — company-scoped archetype roles are never mirrored to SuperTokens (authz reads the DB; only the global kobalt_admin claim is mirrored, and this flow never touches it). Invalidates the user's permission + vendor-access caches so the change takes effect at once across replicas.