support: return 403/500 on badge-count instead of fake zero
Respond 403 "Support is not enabled" when disabled and 500 with the
error envelope on client exceptions, matching the Wave 0 registerTask
contract so the UI can distinguish disabled from failing from empty.
Add unit coverage for the three paths.