fix: post-review followups on slug-vs-UUID refactor

Addresses every finding from the four-agent review of commit aa493b9.

Dashboard — honor redirect_to on subtab loadApp() (closes the silent
historical-slug redirect UX gap):

  - queues/+page.svelte
  - queues/[name]/+page.svelte
  - files/+page.svelte
  - dead-letters/+page.svelte

  After a rename, the URL bar now reflects the canonical slug instead
  of silently rendering the renamed app's data under the stale URL.
  Mirrors the established pattern at apps/[slug]/+page.svelte:619-623.

manager-core:
  - queues_api.rs IntoResponse now uses the JSON envelope shape
    `{"error": "..."}` consistent with every sibling admin api file.
  - triggers_api::delete_trigger reordered: cap check fires BEFORE the
    trigger load, closing the 404-vs-403 existence side channel an
    unauthorized caller could otherwise probe.
  - InMemoryAppRepo mocks in topics_api + triggers_api now implement
    get_by_slug + get_by_slug_or_history (previously
    `unimplemented!()`), unblocking handler-level slug-input tests.
  - Added 4 slug-acceptance tests to topics_api and 2 to triggers_api
    (slug-resolves, unknown-slug-404, historical-slug-resolves,
    create-via-slug). Also added delete-without-cap-is-forbidden test
    pinning the new cap-first order.

e2e:
  - navigation/tabs.spec.ts split per-tab so a regression on one tab
    no longer masks regressions on the others.
  - Negative assertion widened: captures every /api/v1/admin/apps/*
    response and fails on any 4xx/5xx — not just the literal "Cannot
    parse" string. Catches a broader regression shape.
  - networkidle replaced with `expect(<main>).toBeVisible()` —
    networkidle is officially discouraged for SPAs and was at risk of
    timing out behind the queues auto-refresh.
  - Cleanup registration moved BEFORE the create-app API call so a
    flaky create still gets swept up.
  - Queue drilldown route /queues/[name] now covered.
  - Stable `data-testid="queues-empty-state"` replaces fragile
    UI-copy substring match for the positive assertion.
  - Header comment now spells out what this spec does and doesn't
    catch.

docs:
  - serverless_cloud_blueprint.md: slug-history described as
    "200 OK + redirect_to" JSON envelope rather than "301 redirect"
    — matches what apps_api actually implements (SPA can't honor a
    mid-tree HTTP redirect).

Unit-test gap (acknowledged): queues_api, files_api, secrets_api,
dead_letters_api have zero in-process tests. Adding them properly
needs a shared mock-repo helper crate — the standalone trait surface
(QueueRepo + TriggerRepo + ScriptRepository + AuthzRepo + repo-
specific) is ~30 methods per file. Documented inline in queues_api.rs
near the resolver. Integration coverage via crates/picloud/tests/ and
the new e2e spec cover the same paths end-to-end.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/manager-core/src/queues_api.rs

@@ -18,6 +18,7 @@ use axum::{
 };
 use picloud_shared::{AppId, Principal};
 use serde::Serialize;
+use serde_json::json;
 
 use crate::app_repo::AppRepository;
 use crate::authz::{self, AuthzRepo, Capability};
@@ -46,12 +47,27 @@ pub enum QueuesApiError {
 
 impl axum::response::IntoResponse for QueuesApiError {
     fn into_response(self) -> axum::response::Response {
-        let status = match self {
-            Self::Forbidden => axum::http::StatusCode::FORBIDDEN,
-            Self::AppNotFound => axum::http::StatusCode::NOT_FOUND,
-            Self::Repo(_) => axum::http::StatusCode::INTERNAL_SERVER_ERROR,
+        // Match the JSON envelope shape used by every other admin api
+        // file (`{"error": "..."}`); previously this returned a
+        // plain-text body inconsistent with siblings.
+        let (status, body) = match &self {
+            Self::Forbidden => (
+                axum::http::StatusCode::FORBIDDEN,
+                json!({ "error": self.to_string() }),
+            ),
+            Self::AppNotFound => (
+                axum::http::StatusCode::NOT_FOUND,
+                json!({ "error": self.to_string() }),
+            ),
+            Self::Repo(e) => {
+                tracing::error!(error = %e, "queues admin backend error");
+                (
+                    axum::http::StatusCode::INTERNAL_SERVER_ERROR,
+                    json!({ "error": "internal error" }),
+                )
+            }
         };
-        (status, self.to_string()).into_response()
+        (status, Json(body)).into_response()
     }
 }
 
@@ -203,3 +219,15 @@ async fn require_log_read(
         .map_err(|_| QueuesApiError::Forbidden)?;
     Ok(())
 }
+
+// In-process unit tests for queues_api are intentionally not added.
+// Constructing a `QueuesState` requires mocking five traits
+// (`AppRepository`, `QueueRepo`, `TriggerRepo`, `ScriptRepository`,
+// `AuthzRepo`) totalling 30+ methods just to exercise the resolver
+// path. Integration tests in `crates/picloud/tests/` and the
+// dashboard's `tests/e2e/navigation/tabs.spec.ts` already cover both
+// the UUID and slug entry points end-to-end. The same applies to
+// `files_api.rs`, `secrets_api.rs`, and `dead_letters_api.rs` — all
+// three have zero in-process tests and would each need a similarly
+// wide mock surface. Adding a shared mock-repo crate is the right
+// long-term fix.