fix(auth): cap upstream 429 Retry-After so quota resets are picked up

[artile]

Fixes #4724.

Problem

A single upstream 429 Retry-After can be huge — ChatGPT returned 561635 (~156h, a weekly quota window) on our instance. Both 429 cooldown paths honored that hint verbatim:

• per-model MarkResult path (conductor_cooldown.go)
• applyAuthFailureState (conductor_cooldown.go)

That parked every credential for days, and nothing re-probes a credential while its cooldown window is open. So when the account was reset upstream (manual reset-credit, or the window rolling over), the proxy kept returning 429 model_cooldown until a systemctl restart cliproxyapi cleared the in-memory cooldown.

The proxy already caps its own quota backoff at quotaBackoffMax = 30 * time.Minute (conductor_refresh.go), so re-probing at that cadence is exactly what a healthy setup already does.

Fix

Cap the honored upstream Retry-After at quotaBackoffMax (30 min) in both 429 cooldown paths. Hints at or below the cap are honored unchanged; the credential now re-probes within half an hour, so an upstream reset is picked up without a restart.

Notes

• The management endpoint POST /v0/management/reset-quota (v7.2.100+) remains the immediate operational escape hatch for a manual reset.
• Huge Retry-After values still work through the retry/wait path (conductor_selection.go), which is already bounded by maxWait.

Tests

• TestCappedUpstreamRetryAfter — helper edges (zero, negative, below-cap, at-cap, above-cap).
• TestApplyAuthFailureStateCapsUpstreamRetryAfter — 7-day hint → capped at 30 min, and auto-recovers after the capped deadline.
• TestMarkResultCapsUpstreamRetryAfter — per-model path: 7-day hint → capped at 30 min, auto-recovers.

go build ./... and go test ./sdk/cliproxy/auth/... pass.

[github-actions]

This pull request targeted main.

The base branch has been automatically changed to dev.

[jroth1111]

Clean fix — no conflict with the antigravity recovery engine (commit d5b5787). The recovery engine's antigravityRetryAfter honors upstream Retry-After for per-request retry delays inside the executor, while this PR caps the same hint at the conductor-level cooldown path. Different layers, complementary: the executor retries within a 75s budget using the hint, and the conductor re-probes the credential within 30 min regardless of how large the upstream hint was.