fix(test): restore cross-crate test helpers via test-support feature

The Phase A/B/C decomposition broke `cargo test` for the upper crates: test
helpers that were `#[cfg(test)] pub(crate)` in jcode-base/jcode-app-core became
invisible once a consumer (jcode-app-core, jcode-tui, jcode root) was compiled
as a *dependency* rather than under `cfg(test)`. The `--bin jcode` build always
passed, masking ~96 test-target errors (E0425/E0432/E0433/E0616): missing
`storage::lock_test_env`, `auth::test_sandbox`,
`bus::reset_models_updated_publish_state_for_tests`, and the private
`ExternalAuthReviewCandidate` fields.

Fix with the idiomatic `test-support` feature pattern:
- jcode-base: gate the helpers with `#[cfg(any(test, feature = "test-support"))]`
  and widen them from `pub(crate)` to `pub` so downstream test targets can reach
  them. Add a `test-support` feature (off by default).
- jcode-app-core: add test-support-gated read accessors on
  ExternalAuthReviewCandidate (fields stay `pub(crate)`, production surface
  unchanged); add a `test-support` feature forwarding to jcode-base.
- jcode-tui: add a `test-support` feature forwarding to jcode-app-core.
- Each crate that runs its own tests gets a [dev-dependencies] edge on the layer
  below with features=["test-support"]; Cargo feature unification turns it on
  only for test/bench/example builds, never a normal `cargo build`/release
  binary (verified via `cargo tree -e features`).
- jcode-app-core also needed async-stream as a dev-dependency (used by its
  streaming tests, previously only a root dev-dep).
- Update the root cli test to read via the new accessors.

Result: `cargo check --all-targets` is clean for jcode-base, jcode-app-core,
jcode-tui, and jcode (+dev-bins); the previously-failing
pending_external_auth_review_candidates_include_shared_and_legacy_sources test
passes. The normal bin build is unaffected.