fix(sync): don't misclassify plain 403 auth errors as rate limited

packages/backend/convex/githubClient.ts

@@ -102,10 +102,20 @@ export const isRateLimitError = (error: unknown): boolean => {
   if (err.status !== 403 && err.status !== 429) return false;
   if (err.status === 429) return true;
   const message = typeof err.message === 'string' ? err.message.toLowerCase() : '';
-  if (message.includes('rate limit')) return true;
+  if (
+    message.includes('rate limit') ||
+    message.includes('secondary rate limit') ||
+    message.includes('abuse')
+  ) {
+    return true;
+  }
   const headers = err.response?.headers ?? {};
+  // Genuinely exhausted primary rate limit. Note: GitHub sends X-RateLimit-*
+  // headers (including x-ratelimit-reset) on essentially every REST response,
+  // so a bare reset header must NOT be treated as a rate limit — a plain 403
+  // auth failure ("Resource not accessible by integration") carries a positive
+  // x-ratelimit-remaining and must stay classified as an error, not rate limit.
   if (headers['x-ratelimit-remaining'] === '0') return true;
-  if (headers['x-ratelimit-reset'] !== undefined) return true;
   return false;
 };