Use per-request ownership-role override in remove-member and member-role

RemoveMemberService and UpdateMemberRoleService read the required ownership
role from conf.ownershipRole() directly, ignoring the per-team
override-accounts-ownership-role attached param that RequestOverrides
resolves. Every other accounts service (InviteService, and the new
TeamService / GetTeamsService POST path) already goes through
RequestOverrides.ownershipRole(req, conf); align these two so multi-team
deployments that override the ownership role per team authorize these two
endpoints against the right role.

Pure superset: with no override attached, RequestOverrides.ownershipRole
falls back to conf.ownershipRole(), so single-tenant behavior is unchanged.

Author: ujibang

accounts/src/main/java/org/restheart/accounts/RemoveMemberService.java

@@ -2,6 +2,7 @@
 
 import org.restheart.plugins.accounts.AccountsConfigData;
 import org.restheart.accounts.util.Errors;
+import org.restheart.accounts.util.RequestOverrides;
 import org.restheart.exchange.JsonRequest;
 import org.restheart.exchange.JsonResponse;
 import org.restheart.plugins.Inject;
@@ -80,7 +81,7 @@ public void handle(JsonRequest req, JsonResponse res) {
         var membershipProvider = accountsService.getMembershipProvider(req);
         var membership = membershipProvider.activeMembership(callerEmail);
         var membershipRole = membership.map(m -> m.role()).orElse(null);
-        var ownershipRole = conf.ownershipRole();
+        var ownershipRole = RequestOverrides.ownershipRole(req, conf);
         if (membershipRole == null || !membershipRole.equals(ownershipRole)) {
             Errors.error(res, HttpStatus.SC_FORBIDDEN, "Requires " + ownershipRole + " role");
             return;

accounts/src/main/java/org/restheart/accounts/UpdateMemberRoleService.java

@@ -2,6 +2,7 @@
 
 import org.restheart.plugins.accounts.AccountsConfigData;
 import org.restheart.accounts.util.Errors;
+import org.restheart.accounts.util.RequestOverrides;
 import org.restheart.exchange.JsonRequest;
 import org.restheart.exchange.JsonResponse;
 import org.restheart.plugins.Inject;
@@ -82,7 +83,7 @@ public void handle(JsonRequest req, JsonResponse res) {
         var membershipProvider = accountsService.getMembershipProvider(req);
         var membership = membershipProvider.activeMembership(callerEmail);
         var membershipRole = membership.map(m -> m.role()).orElse(null);
-        var ownershipRole = conf.ownershipRole();
+        var ownershipRole = RequestOverrides.ownershipRole(req, conf);
         if (membershipRole == null || !membershipRole.equals(ownershipRole)) {
             Errors.error(res, HttpStatus.SC_FORBIDDEN, "Requires " + ownershipRole + " role");
             return;