fix(api): fail OpenAI oracle provider errors

[cursor]

Bug and impact

ai-oracle could report a successful paid response with an empty analysis when the OpenAI fallback returned a non-2xx error body or an empty response. That logs the call as success and charges credits instead of surfacing the upstream failure.

Root cause

The OpenAI provider branch parsed resp.json() and immediately returned text from choices[0] without checking resp.ok or requiring non-empty output.

Fix

• Throw on non-2xx OpenAI responses in the ai-oracle provider branch.
• Throw on empty OpenAI output so the route falls through to the existing oracle_failed 502 path.
• Updated the hardening test coverage for the provider invariant and refreshed two stale source-shape assertions in the same test file.

Validation

• cd api && npm run build && node tests/tools-credits-hardening.test.mjs