Treat access program denials as terminal errors (#60476)

## What changed

Recognize `access_program_not_enabled` in HTTP 403 responses and response stream errors as a dedicated, non-retryable error. Preserve HTTP diagnostic details and provider stream messages, with a default message when none is supplied.

Stop SSE streams immediately on this error and avoid triggering WebSocket fallback for explicit access program denials. Add a fixed diagnostic label for doctor output and telemetry.

## Testing

Extend coverage for HTTP and WebSocket denials, immediate SSE termination despite retry headers, and doctor diagnostic redaction.

GitOrigin-RevId: 3a41f7bb80ad5e13a87e831b458d17cdd19a4b62

codex-rs/codex-api/src/error.rs

@@ -42,6 +42,8 @@ pub enum ApiError {
     #[error("invalid request: {message}")]
     InvalidRequest { message: String },
     #[error("{message}")]
+    AccessProgramNotEnabled { message: String },
+    #[error("{message}")]
     InvalidAudioInput {
         message: String,
         /// True when the provider rejected an individual clip, independent of request size.
@@ -85,6 +87,15 @@ pub(crate) fn parse_terminal_provider_error(
     let error = error?;
     let code = error.get("code")?.as_str()?;
     match (code, status) {
+        // HTTP 403s retain their request ID and headers in the API bridge.
+        ("access_program_not_enabled", None) => Some(ApiError::AccessProgramNotEnabled {
+            message: error
+                .get("message")
+                .and_then(Value::as_str)
+                .filter(|message| !message.trim().is_empty())
+                .unwrap_or("The requested access program is not enabled.")
+                .to_owned(),
+        }),
         ("budget_reached", None | Some(StatusCode::BAD_REQUEST)) => {
             Some(ApiError::SessionBudgetExceeded)
         }