fix(quota): improve 403 error messaging for forbidden accounts

Instead of showing "Quota access forbidden" generic error, now shows:
- Antigravity: "403 Forbidden - No Gemini Code Assist access"
- Codex: "403 Forbidden - No quota API access"

Keeps success=false with isForbidden flag so UI can show distinct
"403" badge (similar to Antigravity-Manager) rather than conflating
with 0% exhausted state.

403 ≠ 0% exhausted - they are semantically different:
- 403: Account lacks API access entirely
- 0%: Account has access but quota is used up (shows reset time)

src/cliproxy/quota-fetcher-codex.ts

@@ -253,13 +253,16 @@ export async function fetchCodexQuota(
     }
 
     if (response.status === 403) {
+      // 403 = account lacks API access (not same as quota exhausted)
+      // Keep success=false with isForbidden flag for UI to show distinct "403" badge
       return {
         success: false,
         windows: [],
         planType: null,
         lastUpdated: Date.now(),
-        error: 'Quota access not available (free plan may not have quota API access)',
+        error: '403 Forbidden - No quota API access',
         accountId,
+        isForbidden: true,
       };
     }
 

src/cliproxy/quota-fetcher.ts

@@ -407,12 +407,14 @@ async function fetchAvailableModels(accessToken: string, _projectId: string): Pr
     clearTimeout(timeoutId);
 
     if (response.status === 403) {
+      // 403 = account lacks Gemini Code Assist access (not same as quota exhausted)
+      // Keep success=false with isForbidden flag for UI to show distinct "403" badge
       return {
         success: false,
         models: [],
         lastUpdated: Date.now(),
         isForbidden: true,
-        error: 'Quota access forbidden for this account',
+        error: '403 Forbidden - No Gemini Code Assist access',
       };
     }
 

src/cliproxy/quota-types.ts

@@ -45,6 +45,8 @@ export interface CodexQuotaResult {
   accountId?: string;
   /** True if token is expired and needs re-authentication */
   needsReauth?: boolean;
+  /** True if account lacks quota access (403) - displayed as 0% instead of error */
+  isForbidden?: boolean;
 }
 
 /**

ui/src/lib/api-client.ts

@@ -180,6 +180,8 @@ export interface CodexQuotaResult {
   needsReauth?: boolean;
   /** True if result was served from cache */
   cached?: boolean;
+  /** True if account lacks quota access (403) - displayed as 0% instead of error */
+  isForbidden?: boolean;
 }
 
 /** Gemini CLI bucket (grouped by model series) */