Remove internal roles from deactivated customers before billing run

Your deactivated accounts retain internal role memberships, causing access drift and billing confusion. Account admins get role removals so access and billing reconcile before the next billing run.