fix(xai): remap bad-credentials 403s to unauthorized

- normalize xAI `403` bad-credentials responses to `401` before conductor retry handling
- preserve websocket error headers while applying the normalized status/retry hints
- share bad-credentials detection across flat and nested payload shapes for HTTP/websocket paths

Closes: #4046