feat(pool): pin a user to one Claude/Codex pool account

An admin pins a server-mode user to one pool account per tool
(account_pins; PUT /api/accounts/pins with the password step-up and audit,
the Users page's Pin a user, agenthub accounts pin|unpin). The workspace
owner's pin wins over the balancer whenever the pane may use the account;
a pinned login still waits while another pool login holds the home.

server/db.js

@@ -1873,6 +1873,18 @@ for (const col of ["display_name", "email", "avatar_at"]) {
     db.prepare(`ALTER TABLE users ADD COLUMN ${col} TEXT`).run();
   }
 }
+// An admin's pin of one server-mode user to one pool account per tool
+// (server/lib/account-pins.js): that user's new sessions skip the balancer.
+// The account is named, not referenced — the pool lives in files.
+db.exec(`
+  CREATE TABLE IF NOT EXISTS account_pins (
+    user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    tool TEXT NOT NULL CHECK(tool IN ('claude','codex')),
+    account TEXT NOT NULL,
+    pinned_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    PRIMARY KEY (user_id, tool)
+  );
+`);
 
 // An existing database made before auto_vacuum: the setting is stored only by
 // a VACUUM, which rewrites the whole file under an exclusive lock. Done here,