oai: retry once for TLS bad record MAC errors

Add automatic retry logic for the specific TLS error "tls: bad record MAC"
that occurs occasionally with Fireworks API. The first occurrence triggers
an automatic retry, only failing to the user after a second consecutive failure.

This addresses intermittent connection issues without requiring manual
intervention for transient TLS handshake problems.

Co-Authored-By: sketch <hello@sketch.dev>
Change-ID: s701f83a97373c925k
diff --git a/llm/oai/oai.go b/llm/oai/oai.go
index 2b8b3a1..8a450c4 100644
--- a/llm/oai/oai.go
+++ b/llm/oai/oai.go
@@ -733,6 +733,13 @@
 		}
 
 		// Handle errors
+		// Check for TLS "bad record MAC" errors and retry once
+		if strings.Contains(err.Error(), "tls: bad record MAC") && attempts == 0 {
+			slog.WarnContext(ctx, "tls bad record MAC error, retrying once", "error", err.Error())
+			errs = errors.Join(errs, fmt.Errorf("TLS error (attempt %d): %w", attempts+1, err))
+			continue
+		}
+
 		var apiErr *openai.APIError
 		if ok := errors.As(err, &apiErr); !ok {
 			// Not an OpenAI API error, return immediately with accumulated errors