fix(sync): don't misclassify plain 403 auth errors as rate limited

packages/backend/tests/unit/rate-limit.test.ts

@@ -22,6 +22,24 @@ describe('isRateLimitError', () => {
     ).toBe(true);
   });
 
+  test('does not misclassify a plain 403 auth error as rate limited', () => {
+    // GitHub sends X-RateLimit-* headers on essentially every REST response,
+    // including a permission-denied 403 where remaining is still positive.
+    // A reset header being present must NOT count as a rate limit.
+    expect(
+      isRateLimitError({
+        status: 403,
+        message: 'Resource not accessible by integration',
+        response: {
+          headers: {
+            'x-ratelimit-remaining': '4998',
+            'x-ratelimit-reset': '1700000000',
+          },
+        },
+      }),
+    ).toBe(false);
+  });
+
   test('returns false for a 404', () => {
     expect(isRateLimitError({ status: 404 })).toBe(false);
   });