User Management UI — role assignment

[victorsoriadrp]

Context

Workspace owners can already invite members (#3) but cannot change a member's role after invitation. RBAC is enforced backend-side but the UI is read-only.

Acceptance criteria

• Members table in Workspace Settings shows current role with inline edit (owner-only)
• Role change action: confirm dialog explaining the permission impact
• Backend: PATCH /workspaces/{id}/members/{userID} with role change
• Prevent demoting the only remaining owner
• Audit log entry member.role_changed

Related

• Part of User Management UI work for v0.7 (User Management UI — workspace invitations #87, User Management UI — password reset flow #88)