Revoke a scoped role from a team member

REVOKES one built-in RBAC role grant from a member at an access scope — the mirror of assignTeamMemberRole. roleId is the built-in role id; storeId must match the scope the grant was made at (omit it to revoke the network-wide/franchise grant). This NARROWS what the account can do — a security-posture change — so only revoke on an explicit instruction. 404 when the member holds no such (role, scope) grant. Returns the revoked grant. PERMISSION TRAP (solya-pos#950): x-required-permissions says pos.team.manage, and that is what the router gate checks — but the use-case behind it additionally asserts the kernel permission config:manage, and the scope-to-kernel table (SCOPE_KERNEL_PERMISSIONS) maps pos.team.manage to NOTHING. A token-authenticated actor holding exactly the documented scope therefore passes the gate and then fails with a bare 403 from inside the use-case. Read a 403 here as a server-side grant gap, not as a malformed request, and do not retry it with a different body.