feat: choose your own pool account; skills with "token" in a doc name upload; System Health off Linux

- Skill snapshot/upload: a key file's name (.env, *.pem, id_rsa, .netrc,
  .credentials.json…) is always refused, but a word like token/secret/
  password/credential only in a data file's name — design-tokens.md or
  count_tokens.py is skill content, not a key.
- System Health: off Linux the History, CPU threads and Busiest processes
  cards (all read from /proc) are left out instead of shown empty; the CPU
  bar without a sample and Windows' always-zero Load row go too.
- Users pick their own pool account per tool (/api/me/pool-accounts,
  Settings → AI tools), within their groups, refused while pinned.
- Admin user detail, 9router update, session replay and Antigravity
  catalog changes from parallel sessions.

server/lib/codex-pool.js

@@ -362,9 +362,9 @@ function pick(member, ownerId = null) {
   // in their home stays: one auth.json per home.
   const allowed = require("./pool-groups").allowed(ownerId, "codex");
   usable = usable.filter((a) => allowed(a.name));
-  // A pinned API key goes in by env and wins outright; a pinned ChatGPT login
-  // waits while another login holds this home.
-  const pin = require("./account-pins").pinFor(ownerId, "codex");
+  // A pinned (or the owner's own chosen) API key goes in by env and wins
+  // outright; a pinned ChatGPT login waits while another login holds this home.
+  const pin = require("./account-pins").preferredFor(ownerId, "codex");
   const pinned = pin ? usable.find((a) => a.name === pin) : null;
   if (pinned && (pinned.kind === "apikey" || !live || live === pinned)) return pinned;
   if (live) return live;