Queue: throw when a failed job can't be stored instead of only logging it #641

Problem

FailedJobHandler (#535) saves a failed job, calls failed(), then fires JobFailedEvent. If saving the failed job throws, it only logs the problem (through LoggerInterface since #608). A job whose final failure couldn't be recorded is a real error, and under Marko's loud-errors rule it shouldn't be reduced to a log line.

Proposal

When storing the failed job fails, throw a typed QueueException (for example failedJobNotStored) that names the job class and id, with the storage exception as previous. Keep the behaviour from #535: failed() is not called when storing fails, so it never runs twice for one job, and the job stays reserved so it's retried and failed again later. Check how each caller handles the new exception:

• the worker: it should exit with a clear error rather than keep pulling jobs while storage is broken. Decide and document this.
• DatabaseQueue::pop() and the sync driver.

Exit criteria

• Storage failure throws QueueException with the cause attached, and no longer only logs
• Tests for the worker, database pop-time and sync paths
• Docs: queue page, failure handling section
• composer ci green

Follow-up from the #608 logger discussion.