fix(auth): answer a paused no-auth provider with a retryable cooldown

[maxmad64bis]

⚠️ base-red inherited: #15306

Summary

During a refusal pause, requests using the shared no-auth connection failed with 401 and the client stopped instead of retrying. The pause path returned no connection, which reads as missing credentials. It now returns a retryable cooldown, so the request waits or receives 429 with Retry-After until the pause ends. Builds on @rapha4lx's diagnosis from #14977.

Related Issues

• Related to fix(resilience): arm free-tier pause only for non-contract shapes (#14313 follow-up) #14977

Validation

• Change type: provider
• Focused tests and category gates from the golden path — focused suites green at the head; the full unit suite, Vitest, the coverage gate, and the production build run in CI.
• npm run lint
• Reconciled with the current active release base; focused checks rerun afterward — rebased on the current release base; focused tests rerun.
• Production-code changes include a new or updated automated test in this PR — new regression test added in this PR covering the changed paths.

Tests Added Or Updated

• tests/unit/noauth-pause-retryable-cooldown.test.ts — 16 cases covering the pause reader, the pause cooldown shape, the six selection criteria, the 429 with Retry-After reply, storage expiry, the refuse-then-request flow, and the combo fallback to the next target.

Coverage Notes

• src/sse/services/auth.ts — covered by tests/unit/noauth-pause-retryable-cooldown.test.ts (pause site answers the cooldown; the other three sites stay unchanged).
• open-sse/services/opencodeFreeTierSkip.ts — covered by tests/unit/noauth-pause-retryable-cooldown.test.ts (remaining-time reader cases).
• src/sse/services/noAuthModelCooldown.ts — covered by tests/unit/noauth-pause-retryable-cooldown.test.ts (envelope shape cases) plus tests/unit/noauth-model-lockout-retryable.test.ts staying green (6 cases).

Reviewer Notes

• Behavior: Values only: 401 before, 429 with Retry-After after, scoped to the refusal pause of the shared no-auth connection. The message text uses only those values, and the 429 status stays clear of the provider breaker set. The combo candidate filter is untouched here, and the pause arming stays in that other change.
• Merge: No shared files with fix(sse): reproduce OpenCode CLI requests and isolate model cooldowns (#14977) #15143, so either order merges cleanly. Stacked daughter fix(auth): pause only the refused model on the no-auth path #15443 shares auth.ts, opencodeFreeTierSkip.ts, noAuthModelCooldown.ts and the 15402 test; merge this PR first, then rebase fix(auth): pause only the refused model on the no-auth path #15443. With fix(auth): serve only catalogued free-access models on credits-exhausted OpenRouter connections #15436 and fix(noauth): show active free-tier pauses on the account card #15483 (shared no-auth files): either order.
• Follow-up: Pause arming stays shaped by fix(sse): reproduce OpenCode CLI requests and isolate model cooldowns (#14977) #15143 and per-model scope is fix(auth): pause only the refused model on the no-auth path #15443; this PR only answers the pause with a retryable cooldown.