fix(manager-core): F-Q-005 preserve AuthzDenied::Repo through service-layer authz checks

Every check_read/check_write/check_publish helper across kv, docs,
files, pubsub, queue services used `.map_err(|_| KvError::Forbidden)?`,
collapsing AuthzDenied::Denied AND AuthzDenied::Repo(repo_err) into
a single Forbidden. A transient Postgres blip during the membership
lookup surfaced as 403 to scripts; operators couldn't distinguish
"real forbidden" from "DB flap during permission check".

Replace each call site with the explicit match pattern already used by
users_service::require (users_service.rs:177-181):

  Ok(())                          → continue
  Err(AuthzDenied::Denied)        → Err(ServiceError::Forbidden)
  Err(AuthzDenied::Repo(e))       → Err(ServiceError::Backend(e.to_string()))

7 call sites updated (2 in kv_service, 2 in docs_service, 2 in
files_service, 2 in pubsub_service, 1 in queue_service).

AUDIT.md anchor: F-Q-005. Depends on F-Q-004 (which added Backend
to QueueError/PubsubError).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/manager-core/src/pubsub_service.rs

@@ -115,13 +115,17 @@ impl PubsubServiceImpl {
 
     async fn check_publish(&self, cx: &SdkCallCx) -> Result<(), PubsubError> {
         if let Some(ref principal) = cx.principal {
-            authz::require(
+            match authz::require(
                 &*self.authz,
                 principal,
                 Capability::AppPubsubPublish(cx.app_id),
             )
             .await
-            .map_err(|_| PubsubError::Forbidden)?;
+            {
+                Ok(()) => {}
+                Err(authz::AuthzDenied::Denied) => return Err(PubsubError::Forbidden),
+                Err(authz::AuthzDenied::Repo(e)) => return Err(PubsubError::Backend(e.to_string())),
+            }
         }
         Ok(())
     }
@@ -217,13 +221,17 @@ impl PubsubService for PubsubServiceImpl {
         };
         // Minting reuses the existing pub/sub publish capability (no new
         // scope — the seven-scope commitment holds).
-        authz::require(
+        match authz::require(
             &*self.authz,
             principal,
             Capability::AppPubsubPublish(cx.app_id),
         )
         .await
-        .map_err(|_| PubsubError::Forbidden)?;
+        {
+            Ok(()) => {}
+            Err(authz::AuthzDenied::Denied) => return Err(PubsubError::Forbidden),
+            Err(authz::AuthzDenied::Repo(e)) => return Err(PubsubError::Backend(e.to_string())),
+        }
 
         let (Some(topic_repo), Some(secrets)) = (self.topics.as_ref(), self.secrets.as_ref())
         else {