Fix 403 on test-woo: add User-Agent header, classify 403 as WooForbiddenError

WordPress security plugins (Wordfence, WAF) block the default
Python-urllib User-Agent with 403. Send a descriptive User-Agent on
all Woo requests. Also add WooForbiddenError so 403 is classified
distinctly from 401 (auth) per SETTINGS-80, and surface a clear
message in test-woo.

backend/app.py

@@ -191,6 +191,7 @@ from .woo import (
     WooConnectionError,
     WooCredentialsMissing,
     WooError,
+    WooForbiddenError,
 )
 
 
@@ -218,6 +219,8 @@ async def test_woo() -> dict[str, Any]:
         result = taxonomy_mod.sync(client, get_connection())
     except WooAuthError as e:
         return {"ok": False, "detail": f"auth rejected by store: {e}", "taxonomy_anchor": None, "taxonomy_last_sync_at": None}
+    except WooForbiddenError as e:
+        return {"ok": False, "detail": f"request blocked by store (403): {e}", "taxonomy_anchor": None, "taxonomy_last_sync_at": None}
     except WooConnectionError as e:
         return {"ok": False, "detail": f"store unreachable: {e}", "taxonomy_anchor": None, "taxonomy_last_sync_at": None}
     except WooError as e: