Workspace Role Change

Task

This workspace app has a backend with routes and services, a mock database, and a small frontend client. Members can be listed and invited. Add the missing feature: an endpoint that changes a member's role, the audit record for it, and the client method the web app will call. Read how the existing code works before you add to it.

Requirements

1. run(seed, steps) builds a fresh database from seed.members, runs the steps in order, and resolves to {results, members, audit}: one result per step, then the final members and audit tables. A step is {actor, method, path, body} for a raw request, with the result {status, body}, or {actor, call, args} for a call through the frontend client, with the result {ok: true, value} or {ok: false, status, error}. Do not change the arguments.
2. New: PATCH /members/:id/role with the body {role} changes a member's role and answers 200 {member}. Refusals, checked in this order: the actor is not an owner or an admin, 403 forbidden; role is not owner, admin or member, 400 invalid_role; there is no such member, 404 member_not_found; an admin is promoting someone to owner or changing an owner, 403 forbidden; the change would demote the only owner, 409 last_owner.
3. Every role change writes one audit record: {action: "member.role_changed", actor, target, from, to}. The new role and the audit record are saved together or not at all. Setting a member to the role they already have answers 200 and writes nothing.
4. New: the frontend client gets changeRole(memberId, role). It sends the request above and resolves to the updated member. It rejects the way the other client methods do.
5. The existing behavior stays as it is: GET /members, POST /invites, 401 unauthorized for an unknown actor, 404 not_found for an unknown route, and 500 internal when something unexpected throws.