LeaveOrganization removes the calling user from the organization. No RBAC authorization is required — the caller can only remove themselves. The handler verifies that the user being removed is the authenticated caller.