User Role Management

Promote a user to platform_admin or revoke them back to user. Changes are applied through the platform-admin API, which refuses self-demotion and role changes made while impersonating, and records an audit entry.