[JJC-20260618-005-D] P1/P2 cleanup: structured errors, privacy audit, timeout SSOT, view-model tests

13 items, 555-line diff, build + 15/15 tests green.

ARCH-A3: Phase.error now carries ErrorKind (micDenied/speechDenied/asr/llm/
appGroupUnavailable/unknown) so the UI can pick icons/copy without parsing
free-form strings. Phase.ErrorKind, Phase, LLMError all Equatable.

ARCH-A4: Every TextField in APISettingsCard gets .keyboardType(.asciiCapable)
to defeat SwiftUI's iOS 18 system-keyboard hand-off that auto-suggests
Chinese/emoji and corrupts API keys / URLs / model names.

ARCH-A5 + DOC-3: PrivacyInfo.xcprivacy audited for honesty. Removed three
declared-but-unused APIs (FileTimestamp / DiskSpace / SystemBootTime) and
added ActiveKeyboards (DDA9.1) to the extension (it actually calls
advanceToNextInputMode in the tap path). Main App now declares only
UserDefaults (CA92.1). CHANGELOG updated.

ARCH-A6: Extracted PermissionManager (mic+speech permission flow, iOS 17
branching) and AppGroupPersistor (App Group load/persist) from the God
Object. KeyboardViewController drops 515 → 459 lines. KeyboardPipelineController
left in-place per risk plan — pressBegan state machine is too race-sensitive
to refactor in this pass.

RED-2: Deleted unused Theme enum (no call sites).
RED-3: Deleted unused cardStyle() alias (no call sites).
RED-7: Single source of truth for LLM timeout — LLMClient.requestTimeout +
LLMClientFactory.defaultRequestTimeout; PolishingService derives timeout from
defaultRequestTimeout+1 instead of hardcoding 15.
RED-8: ASRService.transcribe now emits .capability(onDeviceSupported:) as
first event per session; StatusBadge shows REC ⚠️ when the locale fell
back to cloud. New @Published var onDeviceSupported on State.

TEST-1: testPolishThrowsOnTransportTimeout now actually exercises
cancellation: StubURLProtocol delays response 5s, client.polish is
cancelled via Task.cancel(), test asserts the client throws .cancelled /
.transport / .decoding (was: silently passed).

TEST-2: New testPolisherSkipsNetworkWhenModeOff — PolishingService now
short-circuits when modeId == 'off' and returns trimmed input without
invoking LLMClient (proved via injected CountingLLMClient). Service was
moved to OSGKeyboardShared to be reachable from the test target.

TEST-3: KeyboardState (formerly KeyboardViewController.State) extracted
into OSGKeyboardShared so tests can @testable-import it. 5 phase/mode
tests in new KeyboardStateTests. Typealias preserves the old name.

TEST-4: New OSGKeyboardExtTests target with 6 tests covering State
initial values, phase transitions, structured-error round-trip, mode
switching, and InputMode rawValue round-trip.

OSGKeyboardShared/Services/KeyboardState.swift

@@ -0,0 +1,114 @@
+// KeyboardState.swift
+// OSGKeyboard · Shared
+//
+// View-model for the keyboard extension. Lives in Shared (not the
+// extension target) so unit tests can import it directly without the
+// `app-extension` linking headaches. The keyboard view controller
+// (`KeyboardViewController`) re-exports the same type as a typealias so
+// existing call sites (`KeyboardViewController.State`) keep compiling.
+
+import Foundation
+import Combine
+import SwiftUI
+
+@MainActor
+public final class KeyboardState: ObservableObject {
+    public init() {}
+
+    /// Pipeline phase. Errors are structured so the UI layer can choose
+    /// the right icon / copy for each failure mode without
+    /// reverse-parsing a free-form string.
+    public enum Phase: Equatable {
+        case idle
+        case requestingPermissions
+        case recording
+        case processing
+        case error(ErrorKind, message: String? = nil)
+        case denied(Reason)
+
+        /// Why the pipeline failed. `message` is a short, user-facing
+        /// hint (e.g. "请检查主 App 设置"); the structured kind is what
+        /// drives icon / colour.
+        public enum ErrorKind: Equatable {
+            case micDenied
+            case speechDenied
+            case asr(String)
+            case llm(LLMError)
+            case appGroupUnavailable
+            case unknown(String)
+        }
+
+        public enum Reason: Equatable { case mic, speech }
+    }
+
+    public enum InputMode: String, CaseIterable, Identifiable {
+        case off
+        case transcribe
+        case polish
+
+        public var id: String { rawValue }
+
+        public var labelKey: String {
+            switch self {
+            case .off:        return "mode.off"
+            case .transcribe: return "mode.transcribe"
+            case .polish:     return "mode.polish"
+            }
+        }
+    }
+
+    @Published public var phase: Phase = .idle
+    @Published public var level: Double = 0
+    @Published public var mode: InputMode = .polish
+    @Published public var localeId: String = "auto"
+    @Published public var lastTranscript: String = ""
+    /// `true` if the active ASR session is running on-device for the
+    /// current locale. `false` means the request fell back to the
+    /// network (e.g. ja-JP on a device that doesn't ship on-device
+    /// ASR for Japanese). Updated once per recording by the ASR
+    /// pipeline before any `.partial` is emitted.
+    @Published public var onDeviceSupported: Bool = false
+
+    // Action hooks — injected by the view controller at install time.
+    public var beginRecording: () -> Void = {}
+    public var endRecording:   () -> Void = {}
+    public var tapMic:         () -> Void = {}
+    public var openSettings:   () -> Void = {}
+    public var setMode:        (InputMode) -> Void = { _ in }
+    public var setLocale:      (String) -> Void = { _ in }
+    public var insertNewline:  () -> Void = {}
+    public var insertSpace:    () -> Void = {}
+    public var deleteBackward: () -> Void = {}
+
+    // MARK: - Preview helpers (DEBUG only)
+
+    #if DEBUG
+    public static var previewIdle: KeyboardState {
+        let s = KeyboardState()
+        s.phase = .idle
+        s.level = 0
+        s.mode = .polish
+        s.localeId = "zh-Hans"
+        s.lastTranscript = ""
+        return s
+    }
+    public static var previewRecording: KeyboardState {
+        let s = KeyboardState()
+        s.phase = .recording
+        s.level = 0.65
+        s.mode = .polish
+        s.localeId = "zh-Hans"
+        s.lastTranscript = "你好,我想说一段测试"
+        return s
+    }
+    public static var previewProcessing: KeyboardState {
+        let s = KeyboardState()
+        s.phase = .processing
+        s.level = 0
+        s.mode = .polish
+        s.localeId = "zh-Hans"
+        s.lastTranscript = ""
+        return s
+    }
+    #endif
+}