fix(cliproxy): address code review feedback (attempt 3/5)

- Allow partial composite updates in PUT endpoint (|| -> &&)
- Map service validation errors to 400 status, not 404
- Widen 4xx regex to cover full 400-499 range

src/cliproxy/executor/retry-handler.ts

@@ -102,7 +102,7 @@ export async function handleQuotaCheck(provider: CLIProxyProvider): Promise<void
 
 /** Error patterns indicating provider failure */
 export const PROVIDER_ERROR_PATTERNS = [
-  /Error:\s*4[012][0-9]/i,
+  /Error:\s*4[0-9]{2}/i,
   /Error:\s*5[0-9]{2}/i,
   /overloaded/i,
   /quota.*exceeded/i,

src/web-server/routes/variant-routes.ts

@@ -157,8 +157,8 @@ router.put('/:name', (req: Request, res: Response): void => {
     }
 
     if (existing.type === 'composite') {
-      if (!default_tier || !tiers) {
+      if (!default_tier && !tiers) {
-        res.status(400).json({ error: 'Missing required fields for composite update' });
+        res.status(400).json({ error: 'Must provide at least default_tier or tiers' });
         return;
       }
 
@@ -182,7 +182,8 @@ router.put('/:name', (req: Request, res: Response): void => {
       const result = updateCompositeVariant(name, { defaultTier: default_tier, tiers });
 
       if (!result.success) {
-        res.status(404).json({ error: result.error });
+        const status = result.error?.includes('not found') ? 404 : 400;
+        res.status(status).json({ error: result.error });
         return;
       }