fix(app): preserve temporary provider failures in key validation

apps/app/src/app/api/provider-keys/route.ts

@@ -33,7 +33,7 @@ export async function POST(request: Request) {
     if (response.ok && data?.ok === true) return reply({ ok: true }, 200);
     // Never relay arbitrary provider bodies: they can contain sensitive data.
     const error = typeof data?.code === "string" ? errors[data.code] : undefined;
-    return reply({ error: error ?? "The agent could not validate your keys. Please try again." }, 400);
+    return reply({ error: error ?? "The agent could not validate your keys. Please try again." }, data?.code === "provider_unavailable" ? 503 : 400);
   } catch {
     return reply({ error: "Could not reach the agent to validate your keys. Please try again." }, 502);
   }

apps/app/src/app/api/provider-keys/unavailable-regression.test.ts

@@ -0,0 +1,10 @@
+// @vitest-environment node
+import { afterEach, it, expect, vi } from "vitest";
+import { POST } from "./route";
+afterEach(()=>vi.unstubAllGlobals());
+it("keeps a temporary upstream outage distinct from invalid keys", async () => {
+  vi.stubGlobal("fetch",vi.fn().mockResolvedValue(Response.json({ok:false,code:"provider_unavailable",detail:"secret"},{status:503})));
+  const r = await POST(new Request("http://localhost/api/provider-keys",{method:"POST",headers:{"x-openai-api-key":"test-openai","x-jev-api-key":"test-jev"}}));
+  expect(r.status).toBe(503); expect(await r.text()).not.toContain("secret");
+  expect(r.headers.get("cache-control")).toBe("no-store");
+});