Function is_fallback_candidate 

pub fn is_fallback_candidate(err: &ApiError) -> bool

Classify an ApiError as a candidate for the auth → proxy fallback. We only re-route on 401/403 (the stale-credentials signals). Network errors, rate limits, 404s, and 5xx surface as-is so they remain visible to the operator.