Remove an IAM user from the organization

Permanently removes the selected user from the organization (the "Remove" action in the Users page row menus and the detail header). Removal revokes all role assignments, group memberships, active sessions, MFA enrollments and personal API keys, and cannot be undone from the console. The user disappears from the scoped list once the deletion workflow completes; failure leaves the record in a recoverable, queryable state. Validation: userId must exist and be visible in scopeId (404 via ErrNotFound); deletion is blocked with 409 DEPENDENCY_BLOCKED while unresolved dependants exist — e.g. the user is the sole owner of the subscription, owns active service-account bindings, or is referenced by a pending access review; destructive-action permission (owner|admin) is enforced. Async & state: Asynchronous — returns 202 with an Operation record. The user transitions through a deleting state to terminal removed; resource.updated SSE frames (kind iam.user, patch on status) are emitted during teardown and a final resource.deleted frame removes the row from open lists. Errors: 401 unauthenticated; 403 when the caller lacks destructive permission on the scope; 404 when scopeId/userId is unknown; 409 DEPENDENCY_BLOCKED when attachments, dependants, locks or retention rules block removal; 412 when the If-Match revision is stale; 500 on workflow failure. Idempotency/Concurrency: This operation does not use Idempotency-Key; it may be omitted and a sent one is ignored. The removal is applied inline and a new already-SUCCEEDED Operation is returned; repeating it after it succeeded answers 404 NOT_FOUND because the member's user row is gone, so no second teardown runs. An optional If-Match with the user's ETag (from the detail read) is honoured: a stale one is refused 412 before anything is removed; without it the removal proceeds.