fix(auth): pause only the refused model on the no-auth path

[maxmad64bis]

Stacked on #15402. Only the last commit is this PR's; I'll rebase once it lands.

⚠️ base-red inherited: #15306

Summary

A free-tier refusal used to pause the whole provider for about three minutes and now pauses only the refused model, because the pause key holds the provider plus the model. Users saw healthy sibling models skipped after one unrelated refusal, since the key held only the provider name while each request targets one provider plus one model. Now the refused model alone waits out its pause while siblings keep serving, and a refusal recorded without a model still covers the whole provider as before.

Related Issues

• Related to fix(resilience): arm free-tier pause only for non-contract shapes (#14313 follow-up) #14977
• Related to fix(sse): reproduce OpenCode CLI requests and isolate model cooldowns (#14977) #15143

Validation

• Change type: routing
• Focused tests and category gates from the golden path
• npm run lint
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR

Tests Added Or Updated

• tests/unit/opencode-free-tier-per-model-pause.test.ts: 14 cases covering sibling isolation, refused-model pause and expiry, combo-filter scoping, the no-auth pause envelope, model-less reads, unknown and blank models, normalization, the entry bound, and the non-family guard.

Coverage Notes

• open-sse/services/opencodeFreeTierSkip.ts: covered by the new per-model test (isolation, expiry, eviction, normalization, non-family guard).
• open-sse/services/autoCombo/resilienceCandidateFilter.ts: covered by the new per-model test (filter drops only the refused model; pool scenario).
• src/sse/services/noAuthModelCooldown.ts: covered by the new per-model test (envelope fires for the refused model only) plus the existing no-auth pause suite (unchanged, green).
• open-sse/handlers/chatCore.ts: one-line write threading, guarded by the existing no-auth suites driving the chat handler (unchanged, green), key semantics covered by the new per-model test.
• src/sse/services/auth.ts: four-site model threading, non-regression guarded by the existing no-auth suites (unchanged, green), pause semantics covered by the new per-model test.

Reviewer Notes

• Behavior: Before, one refusal paused every model of the provider; after, only the refused model pauses while a model-less refusal still pauses the whole provider. A genuinely global refusal therefore costs one attempt per model per three minutes of pause, which reviewers should weigh against the recovered sibling traffic.
• Merge: Stacked on fix(auth): answer a paused no-auth provider with a retryable cooldown #15402: merge that parent first, then rebase here. Either order works for the shared mutation settings in stryker.conf (fix(dashboard): report headers-wait and client aborts outside transport failures #15248, feat(dashboard): flag uniform provider 5xx regime and split upstream counts #15386) and either order with the sibling failover change fix(auth): serve only catalogued free-access models on credits-exhausted OpenRouter connections #15436 as long as the focused gates are re-run after rebasing. Either order with feat(dashboard): token refresh failures can pause per account instead of blocking the whole provider #15469 and fix(noauth): show active free-tier pauses on the account card #15483, with a rebase on conflict. The size baseline for the provider credentials selection file was rebased from 3623 to 3640 lines to cover the four threaded selection sites, and the connection-status predicate owned by a sibling concern is untouched.
• Follow-up: Exposing active free-tier pauses (provider, model, expiry) in the account card is tracked separately and stays out of this change. The opening order with the related remedy fix(sse): reproduce OpenCode CLI requests and isolate model cooldowns (#14977) #15143 is still to decide, since both remedies stack.