fix(api): fail OpenAI session provider errors

[cursor]

Bug and impact

session-message treated OpenAI non-2xx responses as successful empty assistant messages. A concrete trigger is a gpt-4o or gpt-4o-mini session call when OpenAI returns 401/429/5xx: the route parsed the error JSON, found no choices, returned ok: true with an empty response, appended an empty assistant turn, and allowed the credit/x402 path to record success.

Root cause

The Anthropic branch relied on SDK exceptions, but the OpenAI branch did not check resp.ok before reading data.choices?.[0]?.message?.content ?? "".

Fix

• Reject OpenAI non-2xx responses with openai_error / rate_limited instead of success.
• Reject empty OpenAI choices as provider errors.
• Remove the pending user message before provider-error returns so failed attempts do not corrupt session history.
• Added regression coverage to api/tests/session-pricing.test.mjs.

Validation

• npm run build && node tests/session-pricing.test.mjs