tui: walk detected logins one-by-one with yes/no import prompts

Reworks the in-TUI onboarding Login phase from a single 'type a / 1,3'
selection into a per-candidate walkthrough: we show each detected
external login one at a time and ask whether to import it, with a
Yes/No choice navigable by arrow or vim keys and committed with Enter
or Space (y/n shortcuts also work).

- New ImportReview state machine (index, highlighted choice, approvals)
  lives in OnboardingPhase::Login { import: Option<ImportReview> }
- handle_onboarding_import_review_key drives navigation; on completion
  the approved candidates are imported via
  run_external_auth_auto_import_candidates and the LoginCompleted event
  advances Login -> ModelSelect and activates the provider
- Declining every login (or having none) falls back to the manual
  provider picker
- Welcome card renders the current 'Import <provider> (<source>)? Yes/No,
  N of M' step (LoginImportPrompt); no-import case keeps 'press Enter to
  choose a provider'
- Removed the now-unused text-input import helper
- Added ExternalAuthReviewCandidate::fixture for tests; covered the
  walkthrough, navigation, decline-all fallback, and welcome rendering