fix: detect org-access-denied errors, suppress chat output, and rotate Claude tokens

When a Claude account is suspended, the API returns "Your organization does
not have access to Claude" on the success path or "Failed to authenticate.
API Error: 403 terminated" on the error path. Both are now classified as
'org-access-denied', suppressed from Discord output, and trigger automatic
token rotation. If all tokens are exhausted, enters cooldown without Kimi
fallback (same as usage-exhausted and auth-expired).

Changes:
- agent-error-detection: add isClaudeOrgAccessDeniedMessage(), expand
  classifyClaudeAuthError() and shouldRotateClaudeToken()
- streamed-output-evaluator: detect org-access-denied in success-path chain
- provider-fallback: add NO_FALLBACK_COOLDOWN_REASONS set and
  isPrimaryNoFallbackCooldownActive() helper
- provider-retry: handle org-access-denied in rotation loop
- message-agent-executor / task-scheduler: use generalized no-fallback
  cooldown check
- Tests: +8 test cases across 5 test files (415 total passing)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/streamed-output-evaluator.ts

@@ -1,6 +1,7 @@
 import {
   isClaudeAuthError,
   isClaudeAuthExpiredMessage,
+  isClaudeOrgAccessDeniedMessage,
   isClaudeUsageExhaustedMessage,
 } from './agent-error-detection.js';
 import type { AgentOutput } from './agent-runner.js';
@@ -52,6 +53,8 @@ export function evaluateStreamedOutput(
   ) {
     const triggerReason = isClaudeUsageExhaustedMessage(output.result)
       ? 'usage-exhausted'
+      : isClaudeOrgAccessDeniedMessage(output.result)
+        ? 'org-access-denied'
       : isClaudeAuthExpiredMessage(output.result)
         ? 'auth-expired'
         : undefined;