Recover credentials after transient Kiro failures

[Panniantong]

Summary

• treat upstream 429 as a temporary credential cooldown instead of retrying the same account immediately
• allow TooManyFailures credentials to recover after a short cooldown while keeping manual/quota/refresh-disabled credentials disabled
• add provider and token manager regression coverage for 429 failover and cooldown recovery

Verification

• cargo test kiro::provider::tests::test_call_api_rate_limits_current_credential_and_tries_next
• cargo test kiro::token_manager::tests::test_multi_token_manager_
• cargo build --release

Full cargo test currently has pre-existing anthropic converter model-mapping failures unrelated to this patch.