Reject self status or role changes with 403 in the user update handler,
and make the user service persist role updates so administrators can still
manage other users' roles.
Verification:
- go build -tags "..." ./pkg/service/users/... ./pkg/server/handlers/users/...