agy(gemini): fix false auth-abort in retry loop + add quota fallback to default model

While using the new 3-retry gemini path for live VPN research, two bugs surfaced:
- emit_or_fail checked auth_failed INSIDE the retry loop; a benign mid-run token-refresh line
  matched the over-broad auth regex (bare login|credential|authenticat|oauth|401) and aborted the
  retries with a false "auth error" - even though `gemini -p` auth tested fine. Moved auth-classify
  to AFTER the retries (it only picks the final error message now) and tightened auth_failed to real
  signatures (invalid_grant, not authenticated, login with google, token expired, ...).
- Added quota_exhausted() + a QUOTA FALLBACK: the pinned strong model (gemini-3.1-pro-preview) hit
  "exhausted your capacity on this model" mid-session; emit_or_fail now retries once on the default
  (lighter) model by stripping -m (separate quota). Validated: capped pro run -> fell back -> 2.9KB answer.

CT_THOUGHTS Thought 2 Resolution updated with both. (Search-bot reliability hardening continues.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/CT_THOUGHTS.md

@@ -266,7 +266,13 @@ the docs before probing" workflow - it has to be dependable.
   the search phase - 183 thoughts, only progress-noise text), and buffered `json` => total loss. GEMINI
   search = INTERMITTENT empty turn (a clean re-run succeeded in 122s with a real 2.6KB answer); the
   wrapper only retried once, so two empties in a row failed spuriously.
-- **Gemini fix:** `emit_or_fail` now retries up to 3x with 3s/6s backoff (was 1).
+- **Gemini fix:** `emit_or_fail` now retries up to 3x with 3s/6s backoff (was 1). Two follow-on bugs
+  found+fixed same day while using it: (a) the auth check ran INSIDE the retry loop and a benign mid-run
+  token-refresh line matched the over-broad auth regex -> false "auth error" abort; moved auth-classify
+  AFTER the retries and tightened the regex. (b) added a QUOTA FALLBACK: when the pinned strong model
+  (gemini-3.1-pro-preview) returns "exhausted your capacity on this model", retry once on the default
+  (lighter) model (separate quota) by stripping -m. Validated: a quota-capped pro run fell back and
+  returned a 2.9KB answer.
 - **Grok xsearch fix:** switched to `--output-format streaming-json` (salvage any partial that streamed),
   moderate budget, and **AUTO-FALLBACK to gemini search** when grok doesn't finish (rc!=0 or empty).
   Validated e2e: grok timed out (rc=124) -> fell back -> gemini returned a real sourced answer.