Cloudflare: change member role

Change one member's role within one Cloudflare account: looks up the member by email via the account's members API, opens their single account-wide permission policy, toggles off their current role(s) and toggles on the named new role (matched against the account's own role picker), then saves. Throws if the member has anything other than exactly one permission policy (ambiguous case, not handled). Returns previous and new roles.