fix(sse): isolate credential health from model failures

[KaspaPulse]

Summary

• keep model-not-found, unsupported-model, and model-sync conflicts out of per-credential health
• preserve genuine 401 and credential-signaled 403 failure tracking for the exact selected key
• recover only the credential proven healthy by request execution or connection validation, without clearing sibling keys or active quota cooldowns

TDD evidence

Red phase reproduced three failures: genuine 403 credential rejection was ignored, a successful exact-key validation during cooldown left the key warning stale, and primary-key validation cleared sibling-key health.

Green phase:

• 14 focused regression tests passed
• 85 directly affected key rotation, 402 protection, model fallback, provider validation, and execution-credential tests passed
• touched-file ESLint passed
• Prettier ran on all touched files
• git diff --check passed
• npm run typecheck:core passed
• open-sse project typecheck remains blocked only by inherited errors in src/lib/guardrails/videoBridgeHelpers.ts; that file is unchanged

Build not run: this changes internal health bookkeeping, not a production API contract.

⚠️ base-red inherited: #11449