custom-roles

The capability catalog plus what owner/admin/member get today. The fixed-role half isn't stored anywhere — it restates the live require_admin/get_current_org gates already in routers/*.py, purely for the UI's base-role columns (see gnt.capabilities' own docstring).

Every (user_id -> custom_role_id) assignment in this org, so the settings UI can render "who's on what custom role" in one call instead of one request per role.

Deletes the role outright — member_custom_roles rows referencing it cascade (ON DELETE CASCADE, migration 0056), so anyone assigned to it simply reverts to having no custom role, same as never having been assigned one.

Assigns one member to this custom role — (org_id, user_id) is unique on member_custom_roles, so re-assigning just overwrites, on top of whatever real owner/admin/member role Better Auth's own member table has them at. Validates the target is genuinely a member of this org via that table (raw SQL — no SQLAlchemy model for it, see db/models.py's MemberCustomRole docstring), same pattern org_contacts.py/identity_mapping.py already use to read it; unlike those two read-only paths this does NOT degrade-and-swallow on failure — silently accepting an unverified user_id on a write is the wrong default here, so a genuinely unreachable member table fails this request loudly (500) instead of pretending the assignment worked. Same "don't swallow it" posture org_admin.py's own member-table queries already take for a real write.

Reverts a member back to having no custom role — safe to call even if they were never assigned one (a no-op, not a 404, since the end state is identical either way).