fix(shared): F-Q-004 unify error variants — Forbidden on QueueError, rename Unavailable→Backend

Brings QueueError / PubsubError / InvokeError in line with sibling
shape used by KvError / DocsError / FilesError / SecretsError:

- QueueError gains an explicit Forbidden variant (previously authz
  denial was squashed into Rejected("forbidden") in queue_service.rs:68,
  losing the structured variant a 403-translation layer would need).
- QueueError::Unavailable renamed → Backend.
- PubsubError::Unavailable renamed → Backend.
- InvokeError::Unavailable renamed → Backend.
- Call sites updated (queue_service, pubsub_service, invoke_service,
  Noop* stubs, From<PubsubRepoError> impl, one test assertion).
- New unit test verifying authed-denied → QueueError::Forbidden.

AUDIT.md anchor: F-Q-004.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/manager-core/src/invoke_service.rs

@@ -49,7 +49,7 @@ impl InvokeServiceImpl {
             .scripts
             .get(script_id)
             .await
-            .map_err(|e| InvokeError::Unavailable(e.to_string()))?
+            .map_err(|e| InvokeError::Backend(e.to_string()))?
             .ok_or_else(|| InvokeError::NotFound(format!("id {script_id}")))?;
         if script.app_id != cx.app_id {
             return Err(InvokeError::CrossApp);
@@ -72,7 +72,7 @@ impl InvokeServiceImpl {
             .scripts
             .get_by_name(cx.app_id, name)
             .await
-            .map_err(|e| InvokeError::Unavailable(e.to_string()))?
+            .map_err(|e| InvokeError::Backend(e.to_string()))?
             .ok_or_else(|| InvokeError::NotFound(format!("name {name:?}")))?;
         Ok(ResolvedScript {
             script_id: script.id,
@@ -156,7 +156,7 @@ impl InvokeService for InvokeServiceImpl {
                 root_execution_id: Some(cx.root_execution_id),
             })
             .await
-            .map_err(|e| InvokeError::Unavailable(e.to_string()))?;
+            .map_err(|e| InvokeError::Backend(e.to_string()))?;
         Ok(execution_id)
     }
 }