Fix 403 on test-woo: add User-Agent header, classify 403 as WooForbiddenError

WordPress security plugins (Wordfence, WAF) block the default
Python-urllib User-Agent with 403. Send a descriptive User-Agent on
all Woo requests. Also add WooForbiddenError so 403 is classified
distinctly from 401 (auth) per SETTINGS-80, and surface a clear
message in test-woo.

backend/tests/test_woo.py

@@ -14,6 +14,7 @@ from backend.woo import (
     WooClient,
     WooConnectionError,
     WooCredentialsMissing,
+    WooForbiddenError,
     WooServerError,
 )
 from backend import taxonomy as taxonomy_mod
@@ -138,3 +139,25 @@ def test_anchor_stable_across_identical_syncs(db_dir):
     c2, _ = _client([cats, tags, attrs])
     r2 = taxonomy_mod.sync(c2, db_mod.get_connection())
     assert r1["taxonomy_anchor"] == r2["taxonomy_anchor"]
+
+
+def test_403_raises_forbidden_error(db_dir):
+    def fake_request(url, method, data, headers):
+        raise WooForbiddenError("request forbidden (403)")
+
+    c = WooClient("admin", "secret", "https://store.example.com", request=fake_request)
+    with pytest.raises(WooForbiddenError):
+        c.get_categories()
+
+
+def test_requests_include_user_agent(db_dir):
+    seen_headers = {}
+
+    def fake_request(url, method, data, headers):
+        seen_headers.update(headers)
+        return 200, {"X-WP-TotalPages": "1"}, b"[]"
+
+    c = WooClient("admin", "secret", "https://store.example.com", request=fake_request)
+    c.get_categories()
+    assert "User-Agent" in seen_headers
+    assert "SlabUploader" in seen_headers["User-Agent"]