Add provider key cycle stats reset handling

apps/aether-gateway/src/handlers/admin/provider/oauth/errors.rs

@@ -16,8 +16,13 @@ fn oauth_invalid_reason_is_account_level_block(reason: Option<&str>) -> bool {
     if reason.starts_with(OAUTH_ACCOUNT_BLOCK_PREFIX) {
         return true;
     }
-    aether_admin::provider::status::resolve_account_status_snapshot(None, None, Some(reason))
-        .blocked
+    let snapshot =
+        aether_admin::provider::status::resolve_account_status_snapshot(None, None, Some(reason));
+    snapshot.blocked
+        && !matches!(
+            snapshot.code.trim().to_ascii_lowercase().as_str(),
+            "oauth_token_invalid" | "oauth_expired" | "oauth_refresh_failed"
+        )
 }
 
 pub(crate) fn build_internal_control_error_response(
@@ -142,7 +147,7 @@ pub(crate) fn merge_provider_oauth_refresh_failure_reason(
         return Some(refresh_reason.to_string());
     }
     if current_reason.starts_with(OAUTH_EXPIRED_PREFIX) {
-        return None;
+        return Some(refresh_reason.to_string());
     }
     if oauth_invalid_reason_is_account_level_block(Some(current_reason)) {
         return None;
@@ -183,4 +188,15 @@ mod tests {
             None,
         );
     }
+
+    #[test]
+    fn refresh_failure_replaces_access_token_expired_marker() {
+        assert_eq!(
+            merge_provider_oauth_refresh_failure_reason(
+                Some("[OAUTH_EXPIRED] access token invalid"),
+                "[REFRESH_FAILED] Token 续期失败 (401): refresh_token 无效",
+            ),
+            Some("[REFRESH_FAILED] Token 续期失败 (401): refresh_token 无效".to_string()),
+        );
+    }
 }