fix: handle 403 and unexpected errors in AI pool instead of crashing

403 (forbidden/blocked model) now permanently disables the slot and
tries the next provider. Any other unexpected errors (JSON parse,
network, etc.) get a 10s cooldown instead of aborting the entire pool.
This prevents "Max retries exceeded" when some models are blocked.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/server/src/providers/pool.ts

@@ -112,6 +112,14 @@ export class AIProviderPool {
           continue;
         }
 
+        if (error.status === 403) {
+          // 403: model blocked at org level or forbidden — permanently disable
+          slot.disabled = true;
+          logger.warn(`Forbidden (403) on ${slot.provider.name}, permanently disabled. Trying next...`);
+          this.currentIndex = (this.currentIndex + 1) % this.slots.length;
+          continue;
+        }
+
         if (error.status === 404) {
           // 404: model does not exist on this provider — permanently disable the slot
           slot.disabled = true;
@@ -128,7 +136,11 @@ export class AIProviderPool {
           continue;
         }
 
-        throw error;
+        // Any other error (JSON parse, network, etc.) — cooldown and try next
+        slot.cooldownUntil = Date.now() + 10_000;
+        logger.warn(`Unexpected error on ${slot.provider.name}: ${error.message || error.status}. Trying next...`);
+        this.currentIndex = (this.currentIndex + 1) % this.slots.length;
+        continue;
       }
     }