`DELETE /users/{id}` — remove a user from the org.

The **one** authenticated route that does not require a valid `x-vf-team-id` ([`SelfAuthContext`]). The client derives its acting team from the `team_ids` this returns, so requiring an acting team to ask would be unsatisfiable — and every other route that could report memberships is gated on the very header that is wrong when the client needs to reconcile. ⚠️ The id is `auth.user_id`, the signature-verified `sub`. There is no caller-supplied id here and there must never be one: the acting-team check this route skips is what scopes a request to a team.