Surface what an OpenAI-compatible gateway actually refused

A gateway can answer a failed generation with HTTP 200 and put the reason
in the body: a top-level `error` object and no `choices`, or
`choices[0].error` beside `finish_reason: "error"` when a generation dies
mid-flight. Both fell through to the empty-content throw, so a dead credit
balance, a data-policy block, a rate limit and a model that is down all
recorded the same hop: status 0, reason "returned empty content", no
excerpt. Nothing on the provider health card told them apart.

Raise the shape a non-2xx reply raises instead, with the gateway's own
message leading and its `error.code` as the status when that code is an
HTTP error status. The chain classifier, the health ledger and the card
then see 402 / 403 / 429 / 503 and treat each of them the way they treat
the same status on the wire. Message and excerpt are bounded and
key-redacted by the same helper the non-2xx path uses, so remote text is
no more trusted here than it is there.

Gated on the gateway tag: api.openai.com signals every failure with a
status, so the pinned tags parse exactly as before, and a genuine empty
reply stays the empty-content throw it was. The local-endpoint provider
had the same hole on its buffered path, its buffered-reply fallback and
its stream, and gets the same treatment. The body classifier learned the
two account-side refusals a gateway words in its own vocabulary rather
than the vendor's.

docs/integrations/ai-providers.md

@@ -197,6 +197,15 @@ JSON surfaces send the standard
 the field is detected on the first refusal and retried without it,
 so strict gateways and older local servers both work unmodified.
 
+**When the gateway refuses.** OpenRouter answers a refused generation
+with HTTP 200 and the reason inside the body, so every refusal used to
+reach the provider health card as an empty reply with no status. It now
+carries the gateway's own status and message — 402 out of credits, 403
+blocked, 429 rate-limited, 502 model down. The two account settings
+behind most refusals are an empty credit balance and a data-policy or
+zero-retention restriction that leaves no eligible provider for the
+model you picked; both are changed in the gateway account, not here.
+
 **The Local provider still works for this** and nothing about it
 changed — it speaks the same wire and honours the same base URL. Pick
 the gateway provider when the endpoint is a gateway (it says so in