fix(google-docs): handle AI kill switch access denial [INTEG-3827]

[Mitch Goudy (mgoudy91)]

Summary

Surface backend ai-access-denied access denials clearly in the Google Docs app so denied orgs and spaces do not hit generic failures during OAuth and AI import flows.

Changes

• normalize app action and agent API access-denied responses into a dedicated AI access error utility
• move the page into a blocked state when AI access is denied instead of continuing with generic workflow or OAuth errors
• add focused test coverage for error normalization and the blocked page behavior

Updated in:

• apps/google-docs/src/locations/Page
• apps/google-docs/src/services/agents-api.ts
• apps/google-docs/src/utils
• apps/google-docs/test

Notes

• This PR is the frontend UX half of INTEG-3827.
• The companion backend enforcement PR is https://github.com/contentful/agents-api/pull/430.
• Rollout plan: ship this apps PR first (or together with the backend PR), then ship the backend PR so kill-switched users get the clearer blocked state as soon as enforcement goes live.
• OAuth is intentionally not the enforcement point; the backend PR owns blocking AI invocation paths, and this PR makes those denials readable in the app.