Admin can remove the owner / other admins (no rank check)

Severity: High · Where: team.ts:89-115 handleRemoveTeamMember does no role/rank comparison → an admin can remove the owner or peer admins. Impact: Authorization bypass / account takeover within a site's team. Fix: Enforce rank rules (can't remove owner; admins can't remove admins).