fix(token-refresh): exempt transient errors from exponential backoff

[HouMinXi]

Summary

OAuth token refresh failures were treated identically to permanent errors: any refresh failure (including network timeouts) triggered exponential backoff up to 4 hours. A transient network blip could take an account out of rotation for hours.

This fix classifies refresh failures and exempts transient network errors (timeout, connection reset, DNS failure) from the exponential backoff ladder. Transient errors get a flat 2-minute retry window instead.

Changes

• buildTransientRefreshRetryUpdate() at tokenHealthCheck.ts:167: sets a flat 2-min retry window, preserves existing permanent streak
• Classifier at tokenHealthCheck.ts:821-843: checks err.name (AbortError/TimeoutError), err.code, err.cause.code first; message regex is fallback only
• useTransient = existingUntil <= transientUntil at line 187: transient failure never shortens a longer permanent backoff
• transient flag always set on refreshCircuit for observability
• 12 new tests in tests/unit/tokenHealthCheck-transient.test.ts

Design decisions

• Only a successful refresh clears the circuit (line 791), not a successful request. The circuit gates only the refresh sweep, not request routing.
• 2 min floor sits below the minimum exponential backoff (5 min at streak=1), ensuring transient errors are always retried faster than permanent ones.
• testStatus preserved on both paths: a refresh-failing connection keeps serving traffic.

Test plan

• 12/12 unit tests pass
• Existing exponential backoff tests still pin the permanent path (streak 2->3, streak 3 = 20 min)
• Transient window < minimum exponential backoff (2 min < 5 min)

UNRESOLVED

1. Account in transient retry stays in rotation while token ages — operator sees upstream errors, not a disabled account
2. No escalation from transient to permanent — a permanently-broken network path retries every 2 min indefinitely
3. DB write failure in catch is swallowed (pre-existing, not introduced by this fix)

[diegosouzapw]

Merged via local merge-train on 192.168.0.113 (32 cores) @ train tip 1efacead211f446aac3146c0599eca1ca190ac4c — log /srv/omniroute-train/.claude/worktrees/train-20260804-130726-suite.log.

Green: typecheck:core, check-complexity, check-cognitive-complexity, check-changelog-integrity, test:vitest.

test:unit: 15 failures, and every one of them reproduces identically on the clean release tip with zero PRs boarded (merge-gates §3) — no new failure was introduced by this train. Thirteen are the bare-model routing assertions left stale by #9275, which intentionally moved bare gpt-5.5/gpt-5.6-sol to codex without updating the tests that encoded the old destination; two are the trailing-period message change covered by #9392. A fix for those is in flight.

For reference, check-file-size is also a pre-existing base-red on the bare tip (src/sse/handlers/chat.ts 1846>1845, open-sse/executors/base.ts 1623>1578 — identical numbers with no PRs boarded): baseline drift for the release captain, not introduced here.