b99cbdf194
WordPress security plugins (Wordfence, WAF) block the default Python-urllib User-Agent with 403. Send a descriptive User-Agent on all Woo requests. Also add WooForbiddenError so 403 is classified distinctly from 401 (auth) per SETTINGS-80, and surface a clear message in test-woo.