add unreachable_pub lint, fix all 17 violations

pub → pub(crate) for SseReader methods (used across child modules).
pub → pub(super) for openai::stream_events, tool definitions, store
helpers. pub → private for normalize_link and differentiate_hub_with_graph
(only used within their own files).

Co-Authored-By: Proof of Concept <poc@bcachefs.org>

src/agent/api/mod.rs

@@ -309,7 +309,7 @@ pub(crate) struct SseReader {
 }
 
 impl SseReader {
-    pub fn new(ui_tx: &UiSender) -> Self {
+    pub(crate) fn new(ui_tx: &UiSender) -> Self {
         Self {
             line_buf: String::new(),
             chunk_timeout: Duration::from_secs(120),
@@ -343,7 +343,7 @@ impl SseReader {
     /// Read the next SSE event from the response stream.
     /// Returns Ok(Some(value)) for each parsed data line,
     /// Ok(None) when the stream ends or [DONE] is received.
-    pub async fn next_event(
+    pub(crate) async fn next_event(
         &mut self,
         response: &mut reqwest::Response,
     ) -> Result<Option<serde_json::Value>> {