feat: choose your own pool account; skills with "token" in a doc name upload; System Health off Linux

- Skill snapshot/upload: a key file's name (.env, *.pem, id_rsa, .netrc,
  .credentials.json…) is always refused, but a word like token/secret/
  password/credential only in a data file's name — design-tokens.md or
  count_tokens.py is skill content, not a key.
- System Health: off Linux the History, CPU threads and Busiest processes
  cards (all read from /proc) are left out instead of shown empty; the CPU
  bar without a sample and Windows' always-zero Load row go too.
- Users pick their own pool account per tool (/api/me/pool-accounts,
  Settings → AI tools), within their groups, refused while pinned.
- Admin user detail, 9router update, session replay and Antigravity
  catalog changes from parallel sessions.

server/__tests__/artifacts.test.js

@@ -623,6 +623,18 @@ describe("skills from files or written", () => {
       ["s/.env", "K=1"],
     ]);
     assert.equal(secret.body.error.code, "ESECRET");
+    const word = await upload("/api/artifacts/skill/upload", [
+      ["w/SKILL.md", "---\ndescription: W\n---\n"],
+      ["w/api-token.json", "{}"],
+    ]);
+    assert.equal(word.body.error.code, "ESECRET");
+    // The word alone in a doc or a script is skill content, not a key.
+    const docs = await upload("/api/artifacts/skill/upload", [
+      ["tokens/SKILL.md", "---\ndescription: Design tokens\n---\n"],
+      ["tokens/design-tokens.md", "# tokens"],
+      ["tokens/scripts/count_tokens.py", "print(1)"],
+    ]);
+    assert.equal(docs.status, 201, JSON.stringify(docs.body));
     const out = await upload("/api/artifacts/skill/upload", [["../SKILL.md", "x"]], {
       description: "d",
     });