feat: close BACKEND_GAPS #28/#29/#30 + verify #18

[Jarad-z]

Summary

Closes 4 entries from frontend/docs/BACKEND_GAPS.md:

• #18 promoteQueued correctness — verified already fixed in internal/service/run.go; existing run_promote_test.go covers cases A-E. No code change.
• #28 Artifact exclude PATCH — new PATCH /api/v1/artifacts/{artifact_id} { excluded } (editor+ RBAC; viewer 403; unknown 404).
• #29 Non-owner self-leave — new DELETE /api/v1/workspaces/{ws_id}/members/me (any member; last-owner 409 guard). Adds CountWorkspaceOwners SQL.
• #30 WS message.appended jsonb decode — extracts MessageView into internal/wire so service can use it without backwards import; MessageSvc.AppendUser bus publish now passes wire.ToMessageView(msg). Frontend can drop base64 fallback in lib/parse-message.ts.

Pre-merge code review surfaced two Important findings (fixed in 804e554):

1. Infra errors no longer collapse into ErrForbidden — only pgx.ErrNoRows/ErrNotMember map to 403; other errors propagate as 500.
2. Added 2-owner self-leave success test that was missing from coverage.

API.md updated: two new endpoint sections + two auth-matrix rows.

Test plan

• go test -short ./... — green
• go test -tags=integration ./internal/service/... — 232.5s green (includes 4 new LeaveWorkspace tests, 3 new Artifact.SetExcluded tests, 2 new ws_payload tests)
• go test -tags=integration ./internal/handler/... — 96.1s green (includes 2 new Member.Leave tests, 3 new Artifact.PatchExcluded tests)
• go test -tags=integration on remaining packages (auth, blob, daemon, daemon/backend/*, events) — all green
• Code reviewer pass: Approved with the two Important items addressed inline
• Frontend repo BACKEND_GAPS.md status lines for #18/#28/#29/#30 — needs separate PR in frontend repo

Migration / breaking changes

• None. New endpoints, no schema migration (uses existing artifact.excluded column and existing SetArtifactExcluded query).
• MessageView re-exported as a type alias in internal/handler/jsonb.go, so existing handler code compiles unchanged.

Notes for review

• internal/wire/message_view.go is a new tiny package — accept it as the documented seam between handler and service for wire DTOs. If you prefer the type stayed in internal/handler, the alternative is to inline the decode at the service publish site; the package felt cleaner because the guard tests want the same type.
• TOCTOU race in last-owner guard is documented as best-effort. If strict consistency is needed, follow up with SELECT … FOR UPDATE on workspace_member rows inside a tx. Not blocking IMO since the failure mode is "workspace temporarily has zero owners" which the owner can recover from.
• Artifact 404 detection still uses strings.Contains(err.Error(), "not found") — matches the loose convention in sibling handlers. Introduce ErrArtifactNotFound sentinel if codebase consolidates on that pattern.