Keep auth-required usage errors from rendering as a rate-limit Limited label

The new Codex app-server error 'chatgpt authentication required to read
rate limits' mentions rate limits only as the object it failed to read,
but the status bar's rate-limit classifier matched the phrase and
labeled the chip 'Limited'. Classify authentication-required messages as
auth failures so they get the standard softened refresh copy instead.

src/renderer/src/components/status-bar/tooltip.test.ts

@@ -185,6 +185,20 @@ describe('provider usage error copy', () => {
     )
   })
 
+  it('classifies the Codex chatgpt-auth-required rate-limits read error as auth, not Limited', () => {
+    // Why: the message mentions "rate limits" only as the object it failed to
+    // read; labeling it "Limited" would wrongly imply the user hit a limit.
+    const p = provider({
+      provider: 'codex',
+      error: 'chatgpt authentication required to read rate limits'
+    })
+
+    expect(getProviderUsageStatusLabel(p)).toBe('Refresh failed')
+    expect(getProviderUsageErrorMessage(p)).toBe(
+      'Codex usage could not be refreshed. Agent sessions may still be signed in.'
+    )
+  })
+
   it('keeps generic OAuth and network failures as raw refresh details', () => {
     const oauth = provider({ error: 'OAuth API returned 500' })
     const network = provider({ error: 'Network error while refreshing OAuth usage: ECONNRESET' })

src/renderer/src/components/status-bar/usage-error-copy.ts

@@ -30,7 +30,13 @@ export function getProviderDisplayName(provider: ProviderRateLimits['provider'])
 }
 
 function isUsageRateLimitError(message: string | null): boolean {
-  return Boolean(message && /\brate[- ]?limits?\b|\brate[- ]?limited\b/i.test(message))
+  // Why: Codex app-server's "chatgpt authentication required to read rate
+  // limits" mentions rate limits only as the thing it could not read; treat
+  // authentication-required failures as auth, never as the user being limited.
+  if (!message || /\bauthentication required\b/i.test(message)) {
+    return false
+  }
+  return /\brate[- ]?limits?\b|\brate[- ]?limited\b/i.test(message)
 }
 
 const USAGE_AUTH_ERROR_PATTERNS = [
@@ -45,6 +51,7 @@ const USAGE_AUTH_ERROR_PATTERNS = [
   /\bauth (?:is missing|tokens are missing|does not expose)\b/i,
   /\bunauthori[sz]ed\b/i,
   /\bunauthenticated\b/i,
+  /\bauthentication required\b/i,
   /\bplease reauthenticate\b/i,
   /\bsign in\b/i,
   /\blogged in to another account\b/i,