Manage ClickHouse Cloud organization membership via the Cloud API: list members and roles, change a member's role, invite users, and revoke invitations

Documented steps

1. List assignable roles first: GET /v1/organizations/{organizationId}/roles returns RBACRole objects {id, tenantId, ownerId, name, type: 'system'|'custom', actors[], policies[]}. Capture the `id` values you will pass as `assignedRoleIds`.
2. curl -s -u "$KEY_ID:$KEY_SECRET" https://api.clickhouse.cloud/v1/organizations/<organizationId>/roles
3. List current members: GET /v1/organizations/{organizationId}/members returns Member objects {userId, name, email, role (deprecated), joinedAt, assignedRoles:[{roleId, roleName, roleType}]}.
4. Fetch one member with GET /v1/organizations/{organizationId}/members/{userId} when you only need a single record.
5. Change a member's role: PATCH /v1/organizations/{organizationId}/members/{userId} with {"assignedRoleIds":["<role-uuid>"]} (preferred) or the deprecated {"role":"admin"|"developer"}.
6. curl -s -u "$KEY_ID:$KEY_SECRET" -X PATCH https://api.clickhouse.cloud/v1/organizations/<organizationId>/members/<userId> -H 'Content-Type: application/json' -d '{"assignedRoleIds":["<role-uuid>"]}'
7. Remove a member entirely with DELETE /v1/organizations/{organizationId}/members/{userId}.
8. Invite a new user: POST /v1/organizations/{organizationId}/invitations with {"email":"user@example.com","assignedRoleIds":["<role-uuid>"]}. Only that exact address can accept the invitation.
9. List pending invitations with GET /v1/organizations/{organizationId}/invitations (Invitation objects: id, email, createdAt, expireAt, assignedRoles[]); fetch one with GET .../invitations/{invitationId}.
10. Revoke an unaccepted invitation with DELETE /v1/organizations/{organizationId}/invitations/{invitationId}. There is no PATCH or resend - to change the offered role, delete and re-create.
11. Background docs: https://clickhouse.com/docs/cloud/manage/openapi and https://clickhouse.com/docs/cloud/manage/api/api-overview