feat(pool): pin a user to one Claude/Codex pool account

An admin pins a server-mode user to one pool account per tool
(account_pins; PUT /api/accounts/pins with the password step-up and audit,
the Users page's Pin a user, agenthub accounts pin|unpin). The workspace
owner's pin wins over the balancer whenever the pane may use the account;
a pinned login still waits while another pool login holds the home.

client/src/i18n/locales/en/users.json

@@ -166,7 +166,8 @@
       "EACTIVE": "This server's Claude Code keeps that login in the macOS Keychain. Switch it to another profile first.",
       "ENOTFOUND": "That saved login no longer exists.",
       "ESTALE": "That login was already refreshed elsewhere. Log in again and save it anew.",
-      "EUPSTREAM": "Anthropic could not be reached. Try again."
+      "EUPSTREAM": "Anthropic could not be reached. Try again.",
+      "ENOUSER": "That user no longer exists."
     },
     "source": "From",
     "sources": {
@@ -196,7 +197,27 @@
       "token": "The sk-ant-… that `claude setup-token` printed.",
       "codex": "An OpenAI API key (sk-…), or the whole ~/.codex/auth.json after `codex login` with a ChatGPT account."
     },
-    "refreshFailed": "refresh failed"
+    "refreshFailed": "refresh failed",
+    "pinned": "Pinned: {{users}}",
+    "pinUser": "Pin a user",
+    "pinTitle": "Pin a user to an account",
+    "pinHint": "That user's new sessions always run on the chosen account instead of the least-used one — even when it is full. Sessions already running keep their account; a login waits until the user's sessions on another login have ended.",
+    "pinButton": "Save pin",
+    "user": "User",
+    "chooseUser": "Choose a user…",
+    "loadingUsers": "Loading…",
+    "pinAccount": "Account",
+    "noPin": "None — the least-used account",
+    "pinsTitle": "Pinned users",
+    "unpin": "Unpin {{name}}",
+    "pinDone": {
+      "pinned": "{{user}} now runs on {{account}}",
+      "unpinned": "{{user}} is back on the least-used account"
+    },
+    "toolName": {
+      "claude": "Claude",
+      "codex": "Codex"
+    }
   },
   "delete": {
     "button": "Delete user",