Changes to Replace a user's manageable roles. Rejects paid/unknown roles, refuses self-demotion out of admin, and (in the DB tx) refuses to remove the last admin. On success, the target's sessions are invalidated so the change takes effect on their next request.