feat(provider): flip session to legacy transport on documented 403 upgrade_required (issue #56)

A plan-detection miss (stale whoami cache, unreachable whoami, new plan
alias) that routed a true Go user to the Provider API now self-heals: a
documented `403 upgrade_required` ("You're on the Go plan, the only plan
without API access. Upgrade to GOAT or higher.") pins the session to the
legacy `POST {base}/alpha/generate` transport and retries the same
doStream/doGenerate call once there with the legacy CLI wire format. The
pin is sticky for the lifetime of the model instance — later turns stay on
legacy with no second Provider API hit.

Detection is tolerant to the documented variants (`error.code` /
`error.type` / message substring with upgrade intent); the legacy retry is
bounded to one because only the Provider API descriptor carries the flip
flag, so a 403 on `/alpha/generate` itself flows through the existing
error/redaction/retry pipeline unchanged. Non-403 errors (401/422/429/500)
and 403s without the upgrade body never flip. Usage/cost surfaced is the
retried legacy response's — the failed Provider attempt emits no parts, so
there is no double-counting.

Closes #56