* fix(w8): removing a member revokes their phones; role changes move phones too; a phone's stored role never re-syncs keys
* fix(w8): one removal path revokes keys, phones, grants and routines; stale desktop tokens can't re-sync roles or vouch phones; a grant revoked mid-issue stays revoked
* fix(w8): a removed member's unexpired desktop tokens stop working; changes count from auth's time; desktop re-mints and retries enroll on stale_token
* feat(w8): role-aware plan-denial copy on the phone (owners and admins get the fix, members who to ask)
* fix(w8): W10 copy (per-seat team limit, choose a plan) and FE review (3 s abortable role read, Android live region, more copy cases); no casts
Neil
e998a5ce96