Inference failure: offer reconnect for auth/upgrade-class provider errors #1295

Problem

When inference fails with auth-class errors on OAuth profiles (e.g. xai/default-2 returning bare HTTP 426 Upgrade Required, fatal), the transcript only says Try again or switch models with /model. There is no path naming the affected profile or offering a one-action reconnect, so a fixable credential/upgrade rejection fails on every turn including compaction.

Desired

• For normalized credential_failure (401/403, Codex 404-with-auth-signal, OAuth 426-with-upgrade-signal via a new classifier with quota-marker veto), thread the provider profile through to the terminal message and offer an idle-only one-action reconnect that opens /connect pre-scoped to that kind+profile, re-keys on success, and replays once only when nothing is committed.
• Bare/deprecation 404s, quota, overflow, retryable, and non-OAuth 426s keep current guidance with no reconnect affordance.
• No new bare printable keys in type-to-filter lists; exec/scrollback keeps a plain-text /connect <kind> <profile> fallback.

Plan

Scratch plan at docs/plans/provider-reconnect/ (PRD with trigger matrix, SOLUTION_SCOPE, BUILD_PLAN, planning-only, gitignored). Phase 0 must ground the 426 marker list in the real payload. Durable conclusions to land in docs on implementation.