fix(shared): F-Q-004 unify error variants — Forbidden on QueueError, rename Unavailable→Backend

Brings QueueError / PubsubError / InvokeError in line with sibling
shape used by KvError / DocsError / FilesError / SecretsError:

- QueueError gains an explicit Forbidden variant (previously authz
  denial was squashed into Rejected("forbidden") in queue_service.rs:68,
  losing the structured variant a 403-translation layer would need).
- QueueError::Unavailable renamed → Backend.
- PubsubError::Unavailable renamed → Backend.
- InvokeError::Unavailable renamed → Backend.
- Call sites updated (queue_service, pubsub_service, invoke_service,
  Noop* stubs, From<PubsubRepoError> impl, one test assertion).
- New unit test verifying authed-denied → QueueError::Forbidden.

AUDIT.md anchor: F-Q-004.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/shared/src/invoke.rs

@@ -105,9 +105,10 @@ pub enum InvokeError {
     #[error("invoke rejected: {0}")]
     Rejected(String),
 
-    /// Backend / database error.
+    /// Backend / database error. Named `Backend` to align with KvError /
+    /// DocsError / FilesError / SecretsError / QueueError / PubsubError.
     #[error("invoke backend error: {0}")]
-    Unavailable(String),
+    Backend(String),
 }
 
 /// Test-only stub: every call errors. Lets harnesses build a `Services`
@@ -122,7 +123,7 @@ impl InvokeService for NoopInvokeService {
         _cx: &SdkCallCx,
         _target: InvokeTarget,
     ) -> Result<ResolvedScript, InvokeError> {
-        Err(InvokeError::Unavailable("invoke is not wired in".into()))
+        Err(InvokeError::Backend("invoke is not wired in".into()))
     }
 
     async fn enqueue_async(
@@ -131,6 +132,6 @@ impl InvokeService for NoopInvokeService {
         _target: InvokeTarget,
         _args: serde_json::Value,
     ) -> Result<ExecutionId, InvokeError> {
-        Err(InvokeError::Unavailable("invoke is not wired in".into()))
+        Err(InvokeError::Backend("invoke is not wired in".into()))
     }
 }