feat: choose your own pool account; skills with "token" in a doc name upload; System Health off Linux

- Skill snapshot/upload: a key file's name (.env, *.pem, id_rsa, .netrc,
  .credentials.json…) is always refused, but a word like token/secret/
  password/credential only in a data file's name — design-tokens.md or
  count_tokens.py is skill content, not a key.
- System Health: off Linux the History, CPU threads and Busiest processes
  cards (all read from /proc) are left out instead of shown empty; the CPU
  bar without a sample and Windows' always-zero Load row go too.
- Users pick their own pool account per tool (/api/me/pool-accounts,
  Settings → AI tools), within their groups, refused while pinned.
- Admin user detail, 9router update, session replay and Antigravity
  catalog changes from parallel sessions.

server/db.js

@@ -1972,6 +1972,18 @@ db.exec(`
     PRIMARY KEY (user_id, tool)
   );
 `);
+// A user's OWN choice of one pool account per tool (Settings → AI tools →
+// Pool account, account-pins.js `setChoice`): below an admin's pin, above the
+// balancer, and only among the accounts the user's group may use.
+db.exec(`
+  CREATE TABLE IF NOT EXISTS account_choices (
+    user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    tool TEXT NOT NULL,
+    account TEXT NOT NULL,
+    chosen_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    PRIMARY KEY (user_id, tool)
+  );
+`);
 // Account pool groups (server/lib/pool-groups.js): a team's members run on the
 // team's own pool accounts. One group per user; an account, named like a pin,
 // may serve several groups. Accounts no group lists are the shared pool.