Classify xAI exhausted-credit 403s as billing

xAI responses that said the account had run out of credits or needed a Grok subscription began with HTTP 403, so OpenClaw classified them as auth failures. That left the xAI profile on the shorter auth cooldown and allowed later requests to retry the unavailable provider before falling back.

Extended the xAI-specific billing matcher for the observed exhausted-credit and Grok subscription phrases while preserving the generic core behavior for unrelated 403 responses.

• Routes exhausted xAI accounts into the billing disabled window so fallback model selection can skip the unavailable profile sooner.
• Avoids mislabeling billing/subscription exhaustion as invalid credentials for users operating xAI-backed agents.
• Keeps non-xAI and generic xAI HTTP 403 handling unchanged, limiting the behavior change to the provider-specific billing signals.

• Added direct xAI matcher regression coverage for the new exhausted-credit and Grok subscription phrases.
• Added structured assistant failure-path coverage proving the provider hook wins before generic 403 auth classification.
• Merged via squash as landed commit a5160c1 after focused and adjacent provider error-classification tests were documented in the PR.