Guard pause/resume against disabled backends; clean up CLI errors

- PauseBackend and ResumeBackend return an error (not bool) when the
  backend is disabled, preventing an inconsistent state where the
  health state says "paused" but enabled=false.
- DisableBackend and EnableBackend now log uniform backend-transition
  lines with from/to instead of separate backend-disable/backend-enable
  messages.
- CLI errors strip gRPC boilerplate ("rpc error: code = ... desc = ")
  and display the server message in red (when color is enabled). Both
  the interactive shell and one-shot mode use the same formatError path.

internal/checker/checker_test.go

@@ -358,19 +358,30 @@ func TestPauseResume(t *testing.T) {
 	}
 	c.mu.Unlock()
 
-	b, ok := c.PauseBackend("be0")
-	if !ok {
-		t.Fatal("PauseBackend: not found")
+	b, err := c.PauseBackend("be0")
+	if err != nil {
+		t.Fatalf("PauseBackend: %v", err)
 	}
 	if b.Health.State != health.StatePaused {
 		t.Errorf("after pause: %s", b.Health.State)
 	}
 
-	b, ok = c.ResumeBackend("be0")
-	if !ok {
-		t.Fatal("ResumeBackend: not found")
+	b, err = c.ResumeBackend("be0")
+	if err != nil {
+		t.Fatalf("ResumeBackend: %v", err)
 	}
 	if b.Health.State != health.StateUnknown {
 		t.Errorf("after resume: %s", b.Health.State)
 	}
+
+	// Pause/resume on a disabled backend must return an error.
+	c.mu.Lock()
+	c.workers["be0"].entry.Enabled = false
+	c.mu.Unlock()
+	if _, err := c.PauseBackend("be0"); err == nil {
+		t.Error("PauseBackend on disabled backend: expected error")
+	}
+	if _, err := c.ResumeBackend("be0"); err == nil {
+		t.Error("ResumeBackend on disabled backend: expected error")
+	}
 }