Revoke system administrator privileges from a user

Remove system administrator privileges from a user (SystemAdmin only). Two safety guards: the caller cannot revoke their own privileges, and revoking the last remaining system admin is rejected — both prevent a SystemAdmin from accidentally locking the platform out of system-level administration. Idempotent on already-non-admin users.