Improve error handling for rate limits and timeouts

[naheel0]

The API should distinguish upstream GitHub, model, timeout, and permission failures so users get actionable feedback instead of a generic failure state.

Proposed scope

• Detect rate-limit responses from GitHub and the model provider.
• Add a timeout-specific error message.
• Keep the current auth-required flow intact.

Acceptance criteria

• The UI shows a clear message when the upstream request is rate-limited.
• Timeout failures have a separate user-facing explanation.
• The existing auth-required path still opens the GitHub login flow.