Actionable Bluesky publish errors + refresh-failure handling (#17)

First slice of #17 (validate real publishing) — the code-side hardening that doesn't need live credentials.

• describeBlueskyError maps raw failures to short, actionable messages: rate limit (429), session expired (401/403 → reconnect), image too large (413), transient 5xx, the ATProto body message for other rejects, and network failures. Previously the user saw Bluesky API failed (429): …. These flow to the composer's failure toast and the queue's failure_reason.
• withFreshSession now handles a dead refresh token: marks the identity expired and surfaces "reconnect on Accounts" instead of a cryptic API error.
• 7 new unit tests for the mapper (28 total); tsc exit 0; pickier clean.

Does not close #17 — the "confirm a real post lands" steps still need a real Bluesky app password. Next.