Remove a domain membership from a student

Remove a single domain membership from a student (soft-deactivate).

Identifies the membership by the (student, domain) pair: the student is the {id} path segment, the domain is {domain_id}. DELETE deactivates the membership (active=False, expires_at=now) rather than destroying the row — the mirror of the (re)activating POST, and what the dashboard does — so history is preserved and a later POST can reactivate it.

Returns 204 on success, 404 if the student, the domain, or the membership does not exist in the caller's organization. Deactivating an already-inactive membership is an idempotent 204 no-op (no event); the removed event fires only on an actual active → inactive transition.

Required OAuth scope: students:write