~x-ai/grok-latest → A (3:1)

Commit A fixes a production-blocking path: when OAuth creds exist it never falls back to www.reddit.com (which returns network-security 403 HTML from cloud IPs), adds AuthRejected + forced token refresh/retry, and tightens error reporting—real lasting API reliability. Commit B is a correct but tiny guard reordering so zero-ratio votes skip ensure_item/voted_pairs; valuable data-integrity hygiene, yet far narrower in scope than A’s OAuth redesign.