[IAM] Close IAM lifecycle/edge-case gaps and add an audit log

**Phase 1 — Harden IAM.**

Close lifecycle/edge-case gaps and add an audit trail.

### Scope
- [ ] Last-owner protection (cannot remove/demote the only owner).
- [ ] Ownership transfer correctness + tests.
- [ ] Member-removal cascade (what happens to their custom-role assignments, sessions, issued tokens).
- [ ] **Team suspension semantics**: define what `status = Suspended` does to grants and to already-issued tokens. Intersects billing (past-due → suspend) — coordinate with the billing layer.
- [ ] **Audit log** for IAM mutations: who changed roles / members / access, and when.

### Acceptance
Edge cases handled with tests; suspension semantics documented; IAM mutations are audited.

No files or test paths are named. Start by tracing the IAM lifecycle and the billing past-due-to-suspension entry point, then identify how roles, members, grants, sessions, and issued tokens are handled. Done means the listed edge cases have tests, suspension semantics are documented, and IAM mutations produce an audit trail.

Written by the indexing model from the issue text.