fix: stop Reddit's block page reading as a signed-out session

Reddit answers a throttled client with a large HTML 403 interstitial. To
the comment client that was indistinguishable from a logged-out session:
the body would not parse, so no modhash was found, so it reported
"Reddit did not return a modhash for this session" and returned
session-invalid — which calls auth.invalidate() and so could disrupt
outreach and chat for an account whose session was perfectly healthy.

That matches what prod is doing. u/Saira_Makimad posted successfully 25
seconds after boot and every later attempt failed with that message,
which is the shape of Reddit starting to throttle rather than a session
going bad.

A response is now only treated as a verdict about the session when it is
actually JSON. Non-JSON, at any status, is Reddit refusing to serve us
and stays retryable. A genuine JSON 403, or JSON with no modhash, still
invalidates as before.

When Reddit does report a signed-out session, the log and the recorded
reason now name the cookies visible to the write origin — names and
domains only, never values. Cookies scoped to www.reddit.com rather than
.reddit.com would produce exactly this symptom, and this makes that
answerable from the logs instead of by guesswork.

Also clarify the allowance in the dashboard. It is derived from the trust
level rather than typed in, and it is a rolling 24-hour window, neither
of which the page said. A per-community cap above the account allowance
now says how much of it is actually reachable, because "1 of 10 today"
next to an account limit of 2 reads as far more headroom than exists.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/dashboard/src/features/growth/growth-page.tsx

@@ -86,9 +86,12 @@ function AccountRow({
 function SubredditRow({
   accountId,
   subreddit,
+  dailyAllowance,
 }: {
   accountId: string;
   subreddit: GrowthSubreddit;
+  /** The account-wide ceiling, which binds before any per-community cap. */
+  dailyAllowance: number;
 }) {
   const update = useUpdateGrowthSubredditMutation(accountId);
   const remove = useRemoveGrowthSubredditMutation(accountId);
@@ -102,9 +105,16 @@ function SubredditRow({
     <div className="growth-subreddit-row">
       <div className="growth-subreddit-name">
         <strong>r/{subreddit.subreddit}</strong>
-        <span>{subreddit.postedLast24h} of {subreddit.dailyCap} today</span>
+        <span>{subreddit.postedLast24h} of {subreddit.dailyCap} in the last 24h</span>
       </div>
 
+      {subreddit.dailyCap > dailyAllowance ? (
+        <p className="growth-subreddit-note">
+          Only {dailyAllowance} of these can actually be used today — the account allowance is the
+          overall limit, and this cap only stops one community taking all of it.
+        </p>
+      ) : null}
+
       {subreddit.disabledReason ? (
         <p className="growth-subreddit-note">
           Reddit refused this account here: {subreddit.disabledReason}
@@ -211,12 +221,12 @@ function AccountDetail({ account }: { account: GrowthAccountDetail }) {
 
           <dl className="growth-metrics">
             <div>
-              <dt>Allowance</dt>
-              <dd>{stats.postedLast24h} / {settings.dailyAllowance} today</dd>
+              <dt>Used in last 24h</dt>
+              <dd>{stats.postedLast24h} / {settings.dailyAllowance}</dd>
             </div>
             <div>
               <dt>Trust level</dt>
-              <dd>{settings.trustLevel} of 4</dd>
+              <dd>{settings.trustLevel} of 4 → {settings.dailyAllowance}/day</dd>
             </div>
             <div>
               <dt>Comments live</dt>
@@ -237,9 +247,12 @@ function AccountDetail({ account }: { account: GrowthAccountDetail }) {
           </dl>
 
           <p className="field-hint">
-            The allowance rises on its own while comments survive and earn upvotes, and falls back
-            the moment one is removed or heavily downvoted. Two removals in a row, or a comment the
-            public cannot see, pauses the account for you.
+            The allowance comes from the trust level, not from a setting: level 0 permits 2 comments
+            a day, then 3, 5, 8 and 12. It is a rolling 24-hour window rather than a midnight reset,
+            so capacity frees up 24 hours after each comment. The level rises on its own while
+            comments survive and earn upvotes, and falls back the moment one is removed or heavily
+            downvoted. Two removals in a row, or a comment the public cannot see, pauses the account
+            for you.
           </p>
 
           <div className="growth-pacing">
@@ -331,7 +344,12 @@ function AccountDetail({ account }: { account: GrowthAccountDetail }) {
           ) : (
             <div className="growth-subreddit-list">
               {account.subreddits.map((subreddit) => (
-                <SubredditRow accountId={accountId} key={subreddit.subreddit} subreddit={subreddit} />
+                <SubredditRow
+                  accountId={accountId}
+                  dailyAllowance={settings.dailyAllowance}
+                  key={subreddit.subreddit}
+                  subreddit={subreddit}
+                />
               ))}
             </div>
           )}