Phase 2 seam: expose pure helpers for testing (no logic changes)

Every change here is either dropping `private` (still invisible
outside the module, @testable import just needs internal-or-wider)
or converting a self-independent instance method to `static func`
(ChatViewModel.inferProvider/calculateCost/detectGoodbyePhrase --
none of the three ever touched `self`, and constructing a real
ChatViewModel triggers a real network call in init, so static-ifying
them sidesteps that entirely rather than fighting it). Call sites
updated to `Self.foo(...)` where the static conversion required it.

Touches: GitSyncService's URL/secret-scanning helpers,
EmbeddingService's embedding (de)serialization, ContextSelectionService's
importance scoring, and the request-building/response-parsing helpers
on all four providers (OpenRouter, Ollama, OpenAI, Anthropic) -- the
core AI request/response layer, previously 100% untested.

Verified: full existing test suite (27 tests) still green, no
regressions. Tests for these functions land in the next commit.
Phase 2 of the test-suite rollout plan (peaceful-baking-kurzweil).

oAI/Services/GitSyncService.swift

@@ -507,7 +507,7 @@ class GitSyncService {
         }
     }
 
-    private func detectSecretsInText(_ text: String) -> [String] {
+    func detectSecretsInText(_ text: String) -> [String] {
         let patterns: [(name: String, pattern: String)] = [
             ("OpenAI Key", "sk-[a-zA-Z0-9]{32,}"),
             ("Anthropic Key", "sk-ant-[a-zA-Z0-9_-]+"),
@@ -610,7 +610,7 @@ class GitSyncService {
         }
     }
 
-    private func convertToSSH(_ url: String) -> String {
+    func convertToSSH(_ url: String) -> String {
         // If already SSH format, return as-is
         if url.hasPrefix("git@") {
             return url
@@ -642,7 +642,7 @@ class GitSyncService {
         return url
     }
 
-    private func injectCredentials(_ url: String, username: String, password: String) -> String {
+    func injectCredentials(_ url: String, username: String, password: String) -> String {
         // Convert https://github.com/user/repo.git
         // To: https://username:password@github.com/user/repo.git
 
@@ -697,7 +697,7 @@ class GitSyncService {
         }
     }
 
-    private func sanitizeFilename(_ name: String) -> String {
+    func sanitizeFilename(_ name: String) -> String {
         // Remove invalid filename characters
         let invalid = CharacterSet(charactersIn: "/\\:*?\"<>|")
         return name.components(separatedBy: invalid).joined(separator: "-")