feat(v1.1.9): QueueService trait + Postgres impl + Services bundle wiring

- shared/services.rs: Services::new gains queue: Arc<dyn QueueService>
  positionally after users (mirrors v1.1.8's append of users).
  with_noop_services adds NoopQueueService.
- manager-core/queue_service.rs: QueueServiceImpl wraps QueueRepo with
  script-as-gate authz on AppQueueEnqueue. enqueue clamps max_attempts
  to [1,20] and delay_ms to [0, 86_400_000ms]. depth/depth_pending are
  read-only — no authz check (scripts in the app can see their own
  queue depths). cx.principal threads through as enqueued_by_principal
  (forensic only).
- manager-core/authz.rs: AppQueueEnqueue(AppId) capability — script:write
  scope, granted to editor+ (same trust shape as AppPubsubPublish).
- picloud/lib.rs: wires PostgresQueueRepo + QueueServiceImpl into
  Services::new alongside the existing v1.1.7+ services.
- 11 sdk test binaries + manager-core/realtime_authority.rs updated to
  pass NoopQueueService to Services::new.

Unit tests cover empty queue_name reject, max_attempts clamping
(0/21 → invalid), delay_ms negative-reject, anonymous principal skips
authz, depth/depth_pending pass-through.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/shared/src/services.rs

@@ -23,8 +23,8 @@ use crate::{
     DeadLetterService, DocsService, EmailService, FilesService, HttpService, KvService,
     ModuleSource, NoopDeadLetterService, NoopDocsService, NoopEmailService, NoopEventEmitter,
     NoopFilesService, NoopHttpService, NoopKvService, NoopModuleSource, NoopPubsubService,
-    NoopSecretsService, NoopUsersService, PubsubService, SecretsService, ServiceEventEmitter,
-    UsersService,
+    NoopQueueService, NoopSecretsService, NoopUsersService, PubsubService, QueueService,
+    SecretsService, ServiceEventEmitter, UsersService,
 };
 
 /// SDK service bundle. See module docs for the lifecycle and the v1.1.x
@@ -95,6 +95,13 @@ pub struct Services {
     /// session tokens in the picloud binary; `NoopUsersService` in
     /// tests that don't exercise users.
     pub users: Arc<dyn UsersService>,
+
+    /// Durable per-app named queues (v1.1.9). Scripts get
+    /// `queue::{enqueue,depth,depth_pending}`. Backed by Postgres in
+    /// the picloud binary; `NoopQueueService` in tests that don't
+    /// touch queues. Consumers register via `queue:receive` triggers
+    /// (one per `(app_id, queue_name)`).
+    pub queue: Arc<dyn QueueService>,
 }
 
 impl Services {
@@ -115,6 +122,7 @@ impl Services {
         secrets: Arc<dyn SecretsService>,
         email: Arc<dyn EmailService>,
         users: Arc<dyn UsersService>,
+        queue: Arc<dyn QueueService>,
     ) -> Self {
         Self {
             kv,
@@ -128,6 +136,7 @@ impl Services {
             secrets,
             email,
             users,
+            queue,
         }
     }
 
@@ -150,6 +159,7 @@ impl Services {
             Arc::new(NoopSecretsService),
             Arc::new(NoopEmailService),
             Arc::new(NoopUsersService),
+            Arc::new(NoopQueueService),
         )
     }
 }