fix(devin): 内容策略拦截不再误标账号凭证失效

上游对内容审核拦截与凭证无权限均返回 permission_denied，
按 message 区分：含 content policy 措辞归 ClientFault(400)，
否则才标 CredentialFailed → 账号 error。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Author: Open-Pixel-AI

backend/internal/pkg/devin/errors.go

@@ -70,7 +70,13 @@ func classifyConnectError(err *connect.Error) *Failure {
 	case connect.CodeUnauthenticated:
 		failure.StatusCode, failure.CredentialFailed = 401, true
 	case connect.CodePermissionDenied:
-		failure.StatusCode, failure.CredentialFailed = 403, true
+		// 上游对「内容策略拦截」和「凭证无权限」都回 permission_denied。
+		// 前者是请求级拒绝，按客户端错误处理；不能把账号标成凭证失效。
+		if isContentPolicyRejection(message) {
+			failure.StatusCode, failure.ClientFault = 400, true
+		} else {
+			failure.StatusCode, failure.CredentialFailed = 403, true
+		}
 	case connect.CodeNotFound:
 		failure.StatusCode = 404
 	case connect.CodeResourceExhausted:
@@ -137,3 +143,10 @@ func IsTransientConnectError(err error) bool {
 	}
 	return false
 }
+
+// isContentPolicyRejection 识别上游内容审核拦截文案（permission_denied 复用场景），
+// 例如 "Your request was blocked by our content policy..."。
+func isContentPolicyRejection(message string) bool {
+	lower := strings.ToLower(message)
+	return strings.Contains(lower, "content policy") || strings.Contains(lower, "content_policy")
+}