fix(shared): F-Q-004 unify error variants — Forbidden on QueueError, rename Unavailable→Backend

Brings QueueError / PubsubError / InvokeError in line with sibling
shape used by KvError / DocsError / FilesError / SecretsError:

- QueueError gains an explicit Forbidden variant (previously authz
  denial was squashed into Rejected("forbidden") in queue_service.rs:68,
  losing the structured variant a 403-translation layer would need).
- QueueError::Unavailable renamed → Backend.
- PubsubError::Unavailable renamed → Backend.
- InvokeError::Unavailable renamed → Backend.
- Call sites updated (queue_service, pubsub_service, invoke_service,
  Noop* stubs, From<PubsubRepoError> impl, one test assertion).
- New unit test verifying authed-denied → QueueError::Forbidden.

AUDIT.md anchor: F-Q-004.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/shared/src/pubsub.rs

@@ -52,7 +52,7 @@ pub trait PubsubService: Send + Sync {
         ttl_seconds: Option<i64>,
     ) -> Result<String, PubsubError> {
         let _ = (cx, topics, ttl_seconds);
-        Err(PubsubError::Unavailable(
+        Err(PubsubError::Backend(
             "subscriber tokens are not wired in".into(),
         ))
     }
@@ -80,9 +80,10 @@ pub enum PubsubError {
     #[error("{0}")]
     SubscriberToken(String),
 
-    /// Anything else — Postgres unavailable, etc.
+    /// Anything else — Postgres unavailable, etc. Named `Backend` to
+    /// align with KvError / DocsError / FilesError / SecretsError.
     #[error("pubsub backend error: {0}")]
-    Unavailable(String),
+    Backend(String),
 }
 
 /// Match a stored `topic_pattern` against a published `topic`.
@@ -145,7 +146,7 @@ impl PubsubService for NoopPubsubService {
         _topic: &str,
         _message: serde_json::Value,
     ) -> Result<(), PubsubError> {
-        Err(PubsubError::Unavailable("pubsub is not wired in".into()))
+        Err(PubsubError::Backend("pubsub is not wired in".into()))
     }
 }