primaryRoleId column-write invariant: remove direct writes + real enforcement

Deferred from PLUTO-668 candidate 4 per audit-pluto-ca BLOCK verdict 2026-07-31: src/lib/admin-actions.ts:771 and :2144 directly UPDATE users.primaryRoleId, contradicting the documented convention (trigger-derived only). A column-level REVOKE would both break these live paths AND not actually enforce the invariant (column-level REVOKE does not override an existing table-level UPDATE grant). Needs: (1) remove/refactor the 2 direct writes to route through userRoles instead, (2) pick a real enforcement mechanism (table-level REVOKE won't work either since other users columns need postgres UPDATE access — likely a trigger-based guard or a dedicated non-postgres write role). Design + implementation, not just DDL.