feat: wire role revocation and detachment into the space About tab

[tkuhn]

Closes #639.

Code side of deactivation support for roles, building on nanopub-query's server-side revocation model (knowledgepixels/nanopub-query#129): gen:RevokedRoleInstantiation revokes one (space, agent, role) assignment (admins keyed on gen:hasRole gen:AdminRole), and gen:detachedRole removes a role from a space altogether, cascading to its holders.

Code changes

• KPXL_TERMS: add REVOKED_ROLE_INSTANTIATION and DETACHED_ROLE.
• PostPublishRefresh: treat revocations and detachments as structural publications — a revoked role can change which role-gated views the target sees, so the page structure refreshes after publishing one.
• AboutSpacePanel: pass the space as entitlement/context resource to the members and observers table builders (previously built bare, which made per-row entry actions impossible there), and bump the roles/members/observers view constants to the current heads so View.get's exact-version fallback can no longer surface stale titles or queries.
• QueryApiAccess: bump the ref-scoped roles/members/observers query constants to the versions carrying the hidden action-feed columns (detachRole, revokeAgent) — grlc serves by exact artifact code, so supersedes alone don't redirect the endpoints.

Published counterparts (already live)

• Templates: "Revoking a space role" (RAgP7Hztxe…) and "Detaching a role from a space" (RAVnwxKE…).
• Query supersedes adding detachRole/revokeAgent action-feed columns (IRI-keyed + ref-scoped variants).
• View supersedes: "🎭 Assigned roles" gains a per-row "➖ detach role..." action (hidden on the built-in admin row, which is constitutional); the members and observers views gain per-row "🚫 revoke role..." actions (admin-gated; member-tier-gated on observers).

Verified end-to-end on an isolated jetty with headless Chrome: correct view titles, no leaked action-feed columns, detach only on non-admin role rows, and click-through confirms each action opens its intended template with param_space + param_role/param_agent pre-filled.

🤖 Generated with Claude Code