feat: account pool per tool with groups and a Cursor pool; update runs in the background

- The update dialog can be closed while an update applies: it keeps running,
  the page still reloads itself when the new server is up, and a failure
  re-opens the dialog with its error.
- Account pool card: one tab per AI tool (Claude Code, Codex, Cursor CLI,
  Oh My Pi, and every other installed tool, which says it has no pool),
  accounts as cards with 5-hour and weekly quota shown as what is LEFT plus
  their reset times, and the saved profiles of Settings → AI tools →
  Profiles as cards with "Share to pool".
- Cursor account pool (server/lib/cursor-pool.js): Cursor API keys handed to
  a cursor-agent pane only through tmux -e CURSOR_API_KEY;
  `agenthub accounts add <name> --tool cursor`.
- Pool groups (server/lib/pool-groups.js, /api/accounts/groups): a group's
  members run only on its accounts of each tool, a user in no group on the
  accounts no group lists, a pin still wins. account_pins loses its tool
  CHECK (rebuilt, pins kept); three new tables.
- Oh My Pi login sharing can be switched from its pool tab too.

server/db.js

@@ -1958,16 +1958,63 @@ for (const [col, type] of [
 }
 // An admin's pin of one server-mode user to one pool account per tool
 // (server/lib/account-pins.js): that user's new sessions skip the balancer.
-// The account is named, not referenced — the pool lives in files.
+// The account is named, not referenced — the pool lives in files. The tool
+// list is account-pins.js's `TOOLS`, not a CHECK (a new pool needs no rebuild).
 db.exec(`
   CREATE TABLE IF NOT EXISTS account_pins (
     user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    tool TEXT NOT NULL CHECK(tool IN ('claude','codex')),
+    tool TEXT NOT NULL,
     account TEXT NOT NULL,
     pinned_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
     PRIMARY KEY (user_id, tool)
   );
 `);
+// Account pool groups (server/lib/pool-groups.js): a team's members run on the
+// team's own pool accounts. One group per user; an account, named like a pin,
+// may serve several groups. Accounts no group lists are the shared pool.
+db.exec(`
+  CREATE TABLE IF NOT EXISTS pool_groups (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    name TEXT NOT NULL UNIQUE COLLATE NOCASE,
+    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+  );
+  CREATE TABLE IF NOT EXISTS pool_group_users (
+    user_id INTEGER PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
+    group_id INTEGER NOT NULL REFERENCES pool_groups(id) ON DELETE CASCADE
+  );
+  CREATE TABLE IF NOT EXISTS pool_group_accounts (
+    group_id INTEGER NOT NULL REFERENCES pool_groups(id) ON DELETE CASCADE,
+    tool TEXT NOT NULL,
+    account TEXT NOT NULL,
+    PRIMARY KEY (group_id, tool, account)
+  );
+`);
+// A database from before the Cursor pool: its `tool` CHECK allowed only
+// claude/codex. Rebuilt with every pin kept.
+{
+  const meta = db
+    .prepare("SELECT sql FROM sqlite_master WHERE type='table' AND name='account_pins'")
+    .get();
+  if (meta?.sql?.includes("CHECK(tool IN")) {
+    db.exec(`
+      PRAGMA foreign_keys = OFF;
+      BEGIN;
+      CREATE TABLE account_pins_new (
+        user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        tool TEXT NOT NULL,
+        account TEXT NOT NULL,
+        pinned_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+        PRIMARY KEY (user_id, tool)
+      );
+      INSERT INTO account_pins_new (user_id, tool, account, pinned_at)
+        SELECT user_id, tool, account, pinned_at FROM account_pins;
+      DROP TABLE account_pins;
+      ALTER TABLE account_pins_new RENAME TO account_pins;
+      COMMIT;
+      PRAGMA foreign_keys = ON;
+    `);
+  }
+}
 
 // An existing database made before auto_vacuum: the setting is stored only by
 // a VACUUM, which rewrites the whole file under an exclusive lock. Done here,