An admin shouldn't be able to grant a role bigger than their own

Most role-assignment endpoints check one thing: can the caller manage members? If yes, whatever role...