Revokes a user's access to a specific merchant by soft-deleting the membership record. Only the specified merchant is affected — the user's access to other merchants and the user record itself are never modified. Revocation takes effect immediately: once this call succeeds, the target user is rejected on every merchant-guarded route for that merchant, even when presenting a session token issued before the revocation. The caller must be an active admin of the merchant, or a system_admin. A caller cannot revoke their own access to the merchant they are currently acting on (self-lockout prevention). Removing the last admin from a merchant is blocked for non-system_admin callers.