fix: clearer labels for upstream 403 permission failures

[Wibias]

Summary

• Upstream 403s (e.g. Ollama Cloud plan/model gates) no longer classify as invalid_api_key.
• New codes: permission_denied (default 403) and subscription_required when the upstream text mentions subscription/upgrade.
• Request logs use the upstream message when classifying 403s; GUI Forbidden copy mentions plan/subscription gates.
• Fixes confusing Details UI reported in [Bug]: Oolama api #142.

Test plan

• bun test tests/error-fidelity.test.ts tests/errors-adapter-failure.test.ts tests/request-log.test.ts
• Reproduce an Ollama Cloud Pro-gated model → Logs Details shows permission_denied or subscription_required, not invalid_api_key
• Confirm real 401 / bad-key failures still show invalid_api_key

[lidge-jun]

Thanks for the fix — the direction (clearer 403 labels) was right, and we've landed it on dev with your authorship preserved plus maintainer repairs on top:

• 5292b98f — your PR fix: clearer labels for upstream 403 permission failures #145 checkpoint, absorbed as-is (author: @Wibias, source head fa4ca86).
• 4d285585 — maintainer repairs (Co-authored-by: @Wibias) closing three review findings:
  1. a real 401 carrying subscription phrasing could be reclassified as 403/subscription_required (401 signals now take precedence);
  2. generic 403 "Access denied" still classified as invalid_api_key (now permission_denied, with the Kiro/AWS credential-cue exception scoped);
  3. tests only injected the desired text manually — added tests/server-403-permission-e2e.test.ts driving an Ollama-shaped error body through the real server → adapter → classifier → log path, plus negative 401 regressions.

Full suite green (2,929 tests). Closing this PR in favor of the dev-landed commits; the change will ship with the next release.