patch
https://api.qfp.quantnetwork.net/api/tenants//users//role
Moves one member of the caller's own tenant onto another role.
Requires role:assign, and the role being assigned is gated exactly
as creating a user with it is: a platform role needs the matching
*:create permission, and a custom role may not grant a permission
the caller does not hold.
Checks, in order:
- The path tenant equals the caller's
tenant_idclaim (403). - The caller resolves and is
ACTIVE(401). - The caller holds
role:assign(403). - The target is not the caller (400).
- The target exists within that tenant (404).
- The target is not the tenant's owner (400).
- The target is
ACTIVEorINVITED(400).
A blank or absent roleName means USER. A member already on the
requested role is returned unchanged.

