fix(shared): F-Q-004 unify error variants — Forbidden on QueueError, rename Unavailable→Backend

Brings QueueError / PubsubError / InvokeError in line with sibling
shape used by KvError / DocsError / FilesError / SecretsError:

- QueueError gains an explicit Forbidden variant (previously authz
  denial was squashed into Rejected("forbidden") in queue_service.rs:68,
  losing the structured variant a 403-translation layer would need).
- QueueError::Unavailable renamed → Backend.
- PubsubError::Unavailable renamed → Backend.
- InvokeError::Unavailable renamed → Backend.
- Call sites updated (queue_service, pubsub_service, invoke_service,
  Noop* stubs, From<PubsubRepoError> impl, one test assertion).
- New unit test verifying authed-denied → QueueError::Forbidden.

AUDIT.md anchor: F-Q-004.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/shared/src/queue.rs

@@ -61,6 +61,13 @@ pub enum QueueError {
     #[error("queue_name must not be empty")]
     EmptyName,
 
+    /// Caller principal lacked the required capability. Only raised when
+    /// `cx.principal.is_some()` (script-as-gate; public HTTP skips it).
+    /// Sibling shape across KvError / DocsError / PubsubError — uniform
+    /// for 403 translation at the HTTP boundary.
+    #[error("forbidden")]
+    Forbidden,
+
     /// Payload could not be serialized (e.g. a Rhai FnPtr / closure
     /// captured into the message). Rejected at the SDK boundary; surface
     /// the wording verbatim so scripts see the documented message.
@@ -71,9 +78,10 @@ pub enum QueueError {
     #[error("{0}")]
     InvalidOpts(String),
 
-    /// Backend unavailable (Postgres down, etc.).
+    /// Backend failure (Postgres unavailable, etc.). Named `Backend` to
+    /// align with KvError / DocsError / FilesError / SecretsError.
     #[error("queue backend error: {0}")]
-    Unavailable(String),
+    Backend(String),
 }
 
 /// Test-only stub: every call errors `Unavailable`. Used by harnesses
@@ -90,14 +98,14 @@ impl QueueService for NoopQueueService {
         _payload: serde_json::Value,
         _opts: EnqueueOpts,
     ) -> Result<QueueMessageId, QueueError> {
-        Err(QueueError::Unavailable("queue is not wired in".into()))
+        Err(QueueError::Backend("queue is not wired in".into()))
     }
 
     async fn depth(&self, _cx: &SdkCallCx, _queue_name: &str) -> Result<u64, QueueError> {
-        Err(QueueError::Unavailable("queue is not wired in".into()))
+        Err(QueueError::Backend("queue is not wired in".into()))
     }
 
     async fn depth_pending(&self, _cx: &SdkCallCx, _queue_name: &str) -> Result<u64, QueueError> {
-        Err(QueueError::Unavailable("queue is not wired in".into()))
+        Err(QueueError::Backend("queue is not wired in".into()))
     }
 }