Model fallback

When a turn fails because of a recoverable provider error — expired token (401), permission denied (403), rate limit (429), provider outage (502/503/504), or a transient network failure — zot opens an inline rescue picker over the chat instead of just painting a red banner.

The picker is the same UI as /model, but only shows models from providers you are currently logged in to. The failed model is excluded. Pick one and enter retries the same prompt on the new model; esc dismisses.

Before the picker fires, every provider client does up to two silent retries with short backoff on 502/503/504 and connection-reset errors, so most edge-proxy blips disappear without you seeing it.

A rescue retry intentionally drops launch-time --api-key and --base-url overrides before rebuilding the agent (those are usually the cause) and re-resolves credentials from env vars, auth.json, and provider defaults. Use /model when you want overrides to stick.

Bad-request, context-length, and serialization errors are not routed to the picker because switching models will not fix them.