fix(auth): include error fields in recovery path

Pass errorCode, lastErrorType, and lastErrorSource through the
runtime credentials object so clearAccountError can clear stale
provider error metadata after a real successful request.

Also update the regression test to use getProviderCredentials,
matching the production call path.

src/sse/services/auth.ts

@@ -35,6 +35,8 @@ interface ProviderConnectionView {
   consecutiveUseCount: number;
   priority: number;
   lastError: string | null;
+  lastErrorType: string | null;
+  lastErrorSource: string | null;
   errorCode: string | number | null;
   backoffLevel: number;
 }
@@ -76,6 +78,8 @@ function toProviderConnection(value: unknown): ProviderConnectionView {
     consecutiveUseCount: toNumber(row.consecutiveUseCount, 0),
     priority: toNumber(row.priority, 999),
     lastError: toStringOrNull(row.lastError),
+    lastErrorType: toStringOrNull(row.lastErrorType),
+    lastErrorSource: toStringOrNull(row.lastErrorSource),
     errorCode:
       typeof row.errorCode === "string" || typeof row.errorCode === "number" ? row.errorCode : null,
     backoffLevel: toNumber(row.backoffLevel, 0),
@@ -469,6 +473,9 @@ export async function getProviderCredentials(
       // Include current status for optimization check
       testStatus: connection.testStatus,
       lastError: connection.lastError,
+      lastErrorType: connection.lastErrorType,
+      lastErrorSource: connection.lastErrorSource,
+      errorCode: connection.errorCode,
       rateLimitedUntil: connection.rateLimitedUntil,
     };
   } finally {

tests/unit/auth-clear-account-error.test.mjs

@@ -41,16 +41,8 @@ test("clearAccountError clears stale provider error metadata after recovery", as
     backoffLevel: 2,
   });
 
-  await auth.clearAccountError(created.id, {
-    ...created,
-    testStatus: "error",
-    lastError: "Health check: token refresh failed",
-    lastErrorType: "token_refresh_failed",
-    lastErrorSource: "oauth",
-    errorCode: "refresh_failed",
-    rateLimitedUntil: new Date(Date.now() + 60_000).toISOString(),
-    backoffLevel: 2,
-  });
+  const credentials = await auth.getProviderCredentials("codex");
+  await auth.clearAccountError(created.id, credentials);
 
   const updated = await providersDb.getProviderConnectionById(created.id);
   assert.equal(updated.testStatus, "active");