feat: revoke service access for users

[amandazhuyilan]

Description

AAI-385: Ensure revoking a platform membership also removes the user’s Auth0 role, mirroring the existing group‑revocation behavior completed in #109).

This pull request depends on #122.

Changes

• added PlatformMembership.revoke_auth0_role/revoke helpers that remove the biocommons/platform/* role in Auth0, persist revoked state, and log whether a role change occurred
• PlatformMembership.save_history now persists user_id explicitly so revocation history rows satisfy the NOT NULL constraint.
• Admin revoke endpoint now injects Auth0Client, delegates to the new helper, and logs the Auth0 result; admin fixtures were adjusted to include platform role
• Extended tests

Checklist

• I have commented my code, particularly in hard-to-understand areas
• I have added unit / integration tests that prove my fix is effective or that my feature works
• I have run all tests locally and they pass
• I have updated the documentation (if applicable)
• For any new secrets, I have updated the shared spreadsheet and the GitHub Secrets.

[marius-mather]

looks good, thanks