#22281 Close stale team sockets when roles change

Role changes updated membership but left existing team connections open. Accepted changes now close that member’s sockets in that team, so reconnect applies current access rules. Replayed and same-role syncs preserve current connections.

Builds on #22120. At 7e6f41f34538, all six new socket cases and all 960 API tests pass. The repaired baseline fails four socket cases and passes both controls. CloudDO fanout and the parent authority watcher remain follow-ups.

Changelog

Fixed: Team subscriptions reconnect with current permissions after role changes.