app.tempomusic.staff.revokeStaffRole

Mark a moderator row as revoked. The DID can no longer pass the moderator gate (latency = the moderator-cache TTL, default 30s). Requires the caller to have the `superAdmin` role. A super-admin cannot revoke themselves. Writes a `moderatorRevoked` audit row only when an active row was actually revoked. Idempotent: revoking a DID that is not currently an active moderator returns 200 with `revoked: false` and no audit row.