fix(acp): go offline when Claude/Codex auth expires

[Chessing234]

Summary

• Classify headless Authentication required (-32000) as a non-retryable auth error alongside Re-authenticate / API Error: 401.
• On auth expiry: dead-letter the turn, post a restart-needed notice, stop presence heartbeats, and publish presence offline so the agent stops looking live in the sidebar.
• Document the recovery path in buzz-acp README.

Fixes #3831

Test plan

• cargo test -p buzz-acp --lib auth_error
• Run a managed Claude agent, force claude auth logout (or expire creds), @mention it — expect channel notice + sidebar goes offline, no further online heartbeats
• Re-login + restart harness — presence returns to online and mentions work again

Made with Cursor

[Chessing234]

@tlongwell-block @wesbillman @wpfleger96 mind taking a look when you get a chance?

[HashMac]

Independent macOS managed-agent reproduction. The failure surfaced as:

Agent reported error (code -32000): Failed to authenticate: OAuth session expired and could not be refreshed

The current patch matches Re-authenticate, API Error: 401, and Authentication required, so this exact provider wording still appears to miss is_auth_error() and enter the generic requeue/backoff path. I observed repeated retries while the runtime continued to look available; the channel had no actionable reauthentication state.

Reauthenticating the Claude subscription and restarting the managed runtime restored turns.

Could this PR add a precise match and fail-first test for OAuth session expired and could not be refreshed (ideally constrained to AgentError / code -32000)? Suggested live acceptance:

1. Expire subscription OAuth and mention the agent.
2. One visible reauthentication notice; presence becomes offline/not-ready; no retry storm.
3. Reauthenticate and restart.
4. Presence returns online and one fresh mention produces exactly one turn.

This is the same user-facing failure as #3831, just a fourth message variant.