feat(config): project-scoped .jcode.toml to scope the model picker per project

Problem

Provider allowance is global only (provider.model_picker_providers in
~/.jcode/config.toml). A user who wants one work project pinned to OpenRouter
and another to a different provider cannot scope the model picker per project.

Fix sketch

• Read a project-local .jcode.toml (in the session working directory) that is
  a partial subset of the global config; unknown sections/keys fail open.
• The model picker resolves [provider] model_picker_providers from the
  project file first, falling back to the global config for projects/sessions
  that do not override it.
• jcode-base gains project_model_picker_providers(working_dir); the TUI
  picker passes the session working directory.

Example project file:

[provider]
model_picker_providers = ["openrouter"]

Tests

jcode-base config::project_config_tests — reads the allowlist from a
project file and fails open on absent/malformed files.

PR ready

Branch tom-dyar/jcode:feat/project-scoped-providers (single commit) is pushed
and ready to open as a PR against master; blocked only because tom-dyar is
not a collaborator on this repo.

Start in the jcode-base configuration code and the config::project_config_tests module, then trace how the TUI model picker receives its session working directory. Verify the project file allowlist, fallback to global configuration, and fail-open behavior for absent or malformed files; the issue also notes that an implementation branch is already pushed.