Frontend: Revoke role assignment modal + toast #586

Build the revoke flow — unassigning a single member from the role in a single scope, triggered by the trash (revoke) icon in the Members tab. Modal (per design):

• Title "Revoke role assignment?"
• Body: "Are you sure you want to remove {username} from the {role} role in {scope}? This user will immediately lose all permissions associated with this role for this resource."
• Actions: Cancel / "Revoke access" (destructive).

Maps directly to the existing unassign_role_from_subject_in_scope — no new backend primitive; the only work is the modal and wiring.

Acceptance

• Trash icon opens the modal with the correct username/role/scope interpolated.
• "Revoke access" calls unassign_role_from_subject_in_scope; success/error toast; member list refreshes.
• Works identically for standard and custom roles.

Design: https://www.figma.com/design/xnmQJq1cTRVqNrs31R8zDM/AuthZ---v2?node-id=40000174-2&p=f&t=AfaPxKGH7lD48V93-0