Remove chat roles for deprovisioned users before audit

Your deprovision requests land as button clicks but leave former accounts with active roles, creating audit gaps. IT gets revoked access and clean records so audits pass before the next compliance review.