[ppXD]

Summary

• A credential whose provider has refused it for good is now recorded and named instead of staying Active: a refresh refused for the grant or the client marks it Error with "needs reconnect: " and fails with the typed credential_needs_reconnect; a successful refresh or probe lifts it. A 401 on an access token GitLab retired early is retried once with the token another caller stored (or after one rotation), by NGitLab, the raw calls, and the provider's typed writes. CredentialSummary gains a derived health and the days to expiry.
• A recurring probe asks each provider about a bounded batch of credentials and records what it says: GitLab's real expiry for personal, project and group tokens (also when a token is linked or added), validation for what it accepts, Error only for a definite 401, and a recheck of an Error credential after an hour so it can heal (an OAuth one also on use). The sweep cannot be held by a provider that stops answering: the identity call honours its deadline, a probe that ignores its token is walked away from at the probe deadline, a pass ends at a budget under the tick interval, and a tick that finds the previous pass running skips.
• Reconnecting beside a credential its provider refused (OAuth, token link or credentials API) carries its repositories and group hooks to the new credential, as a disconnect's reconnect does; the repair sweep applies the same rule. A rotated pair a process could not store is stored before the fail-fast applies, so another process's refusal of the consumed refresh token cannot strand it. The GitLab members lookup throws instead of answering Unknown, retries a 429 or 5xx once, and admission refuses with credential_rejected or author_standing_unknown naming the status and the scope needed.

No migration: status Error and last_error already exist. Adding a token through POST /api/credentials/pat or /group-access-token now asks the provider about it (bounded by the 30 s probe deadline); a provider that cannot be reached, is silent or refuses the token leaves the credential added as before and due for the sweep.

Test plan

• Unit: 14550 passed, 1 skipped (resolver on-use recheck window, strategy ordering for both providers, StoreKeptPairAsync, GitLab probe deadline / retry / refusal classification, typed-write resend matrix, pinned deadlines and lock key)
• Integration: sweep deadlines against a server that never answers (probe deadline, pass budget, token-ignoring and thread-blocking probes, overlap skip); reconnect beside a refused credential over all three connect paths plus sweep and census shapes; two-pod kept pair; writer lifts an Error; pusher standing-unavailable refusals; reverted client edit heals on use; add-time expiry (Pat, group token, offline, silent, refused)
• E2E (Surface=Http, 414 passed): a token added through the credentials API reads expiring at once; the three tests that asserted no provider traffic after seeding now count from after the seed
• Each fix was written red-first and mutation-checked (removing the fix turns a test red)
• Staging: watch credential-health-probe for "ran out of its budget" and "previous pass is still running" warnings after deploy
• Follow-up (not in this change): show Error credentials in the Providers dialog and render the repository's credential health in the repository list