fix(backend): guard shared admin-customer users in lifecycles

[kisinga]

• exclude customer_role from admin role checks so disable no longer strips customer access or flags dual-role users as superadmin
• invalidate sessions via SessionService.deleteSessionsByUser so revoked permissions die immediately, not at cache expiry
• add updateCustomerSafe/deleteCustomerSafe: stock mutations rewrite the shared user's login identifier on email change and soft-delete the shared user on customer delete
• soft-delete channel admins (was hard remove), filter them from all query surfaces, reactivate on re-invite