fix: detect claude.ai's 403 session-invalid as an expired key; ChatGPT .1 cookie is optional

claude.ai answers an invalid or expired sessionKey with 403 account_session_invalid, never 401, so the refresh-your-cookie message could not fire for Claude. Auth detection is now a provider decision (_is_auth_failure); Claude matches the 403 on its error code so a real permission error still reports as itself. README and .env.example no longer claim both ChatGPT cookie chunks are required.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LbnmGHnFqDjyhPcCg1SEfF

src/providers/chatgpt.py

@@ -307,9 +307,9 @@ class ChatGPTProvider(BaseProvider):
             )
         return access_token
 
-    def _handle_401(self) -> None:
+    def _handle_auth_failure(self, response: Any) -> None:
         msg = (
-            "[chatgpt] Authentication failed (401 Unauthorized). "
+            f"[chatgpt] Authentication failed (HTTP {response.status_code}). "
             "Your __Secure-next-auth.session-token has likely expired (~7 day lifetime). "
             "The session token is used to obtain a short-lived access token via /api/auth/session. "
             "To refresh: open chatgpt.com in Chrome → F12 → Application → Cookies "
@@ -320,7 +320,9 @@ class ChatGPTProvider(BaseProvider):
         raise ProviderError(
             self.provider_name,
             "authentication",
-            RuntimeError("401 Unauthorized — ChatGPT token expired"),
+            RuntimeError(
+                f"HTTP {response.status_code} — ChatGPT session token expired"
+            ),
         )
 
     # ------------------------------------------------------------------