Function auth_repair_hint 

fn auth_repair_hint(provider: Provider) -> &'static str

The repair line the usage poller logs under an auth-classified failure, keyed on how the account authenticates. A session’s credentials are fixed at its spawn, so both classes point at the flat-key edit on the account block, never a re-authentication of the shared config dir.

The base-url test must stay first: a global [env] setup token reaches base-url accounts too, and the re-mint advice is for a credential that account never reads.