tui/onboarding: resume the most recently active external CLI

When both Codex and Claude Code OAuth logins are present, the
'Continue where you left off?' prompt now offers whichever CLI has the
most recent transcript instead of always defaulting to Codex. Detection
is also sandbox-aware (honors JCODE_HOME via user_home_path) so it
matches the import detectors.

- Add latest_external_cli_session_secs() (cheap mtime-only scan)
- Add detect_external_cli_oauths() returning all present CLIs
- onboarding_most_recent_external_cli() ranks by newest transcript