Surface OpenRouter API errors as bounded enrich-set failure messages

## Problem

When OpenRouter rejects a request (e.g. HTTP 403 key monthly limit exceeded), enrich-set fails with the generic 'Set-enrichment analysis failed.' The client maps every non-200 to a generic api code and discards the response body, so the operator cannot distinguish an exhausted key from a data bug. Reproduced during the HOB run of 2026-09-14: the run died at card 116 with no actionable message.

## Proposed change

Map bounded, path-free API error classes (403 key limit, 401 auth, 429 rate limit) to explicit client error codes and include the code in the workflow error message. Keep the bounded-and-path-free CLI error contract (tests/test_cli.py pins that private causes are never printed).

## Acceptance Criteria

- [ ] AC1: A 403 key-limit response surfaces as an explicit bounded message naming the key limit, with no paths or private content
- [ ] AC2: A 401/429 response surfaces their bounded classes distinctly
- [ ] AC3: The bounded-error CLI contract test remains green and unmodified
- [ ] AC4: A failed acquisition stays resumable; the failed work item keeps its durable attempt record

## Dependencies

None

## Implementation classification

- **Estimated size:** S
- **Orchestration risk:** Normal
- **Reason:** Isolated error-mapping change in one client plus message threading.

Start by locating the OpenRouter client and the enrich-set workflow that currently turns non-200 responses into a generic error. Read tests/test_cli.py first to preserve its bounded-error contract, then trace the failed acquisition path and its durable attempt record. Done means 401, 403 key-limit, and 429 responses produce distinct bounded messages while failed work remains resumable.

Written by the indexing model from the issue text.