fix(a11y): confirm sensitive role removals

[vku2018]

Summary

• add a shared helper that marks admin-role and last-role removals as sensitive
• route member role-removal button clicks through a confirmation step before mutating
• cover the confirmation decision/message behavior with focused node:test coverage

Closes #82

Validation

• PASS: npx eslint app/admin/members/page.tsx lib/api/role-removal.ts test/role-removal-confirmation.test.ts --format compact
• PASS: npx tsc --noEmit --module commonjs --target es2020 --moduleResolution node --esModuleInterop --skipLibCheck --types node test/role-removal-confirmation.test.ts lib/api/role-removal.ts
• PASS: focused compile + node --test test-dist-focused/test/role-removal-confirmation.test.js (4 tests)
• PASS: git diff --check
• BASELINE FAIL: npm test currently fails outside this change because @guildpass/integration-client and vitest are unavailable and existing integration-route mock signatures do not match their typed handlers.