Offboard a team member (disable sign-in)

OFFBOARDS a staff account by flipping its active flag to false, which DISABLES sign-in for that person — the deliberate, auditable way to lock a departed colleague out without deleting their directory row (historic sales and audit trails still reference it). This REVOKES system access, the mirror image of createTeamMember: it is a security-posture change, not an ordinary record edit, so surface an offboarding request to a human and never revoke access autonomously. Unlike updateTeamMember, it takes no body — the path memberId is the whole input, so there is no way to touch any other field, and no risk of the active-defaults-to-true trap that a full-record replace carries. Idempotent: offboarding an already-inactive account is a no-op that returns it unchanged. Reactivation is POST /team/{memberId}/reactivate, NOT an updateTeamMember: the update payload no longer carries active, so offboarding and re-onboarding travel through this guarded pair alone. A member may NOT offboard THEMSELVES (422 BUSINESS_RULE_VIOLATION) — the actor performing an offboard is what guarantees an active holder of the reactivation capability survives it, which is how the last-administrator lockout is made unreachable. There is NO delete endpoint — this never removes a row. 404s for an unknown member.