feat(pool): pin a user to one Claude/Codex pool account

An admin pins a server-mode user to one pool account per tool
(account_pins; PUT /api/accounts/pins with the password step-up and audit,
the Users page's Pin a user, agenthub accounts pin|unpin). The workspace
owner's pin wins over the balancer whenever the pane may use the account;
a pinned login still waits while another pool login holds the home.

server/lib/pty-run.js

@@ -461,19 +461,20 @@ function spawnRun(args) {
   assertCwdAccount(laneId, cwd); // ECWDACCOUNT
   const proxyProfile = resolveProxy(tool, proxy, laneOwner); // EBADPROXY, EUNSUPPORTED
   // A Claude session on the vendor's own API runs on the least-loaded pool
-  // account, if the admin added any (claude-pool.js); an AI Proxy brings its
+  // account, if the admin added any (claude-pool.js) — or the one the
+  // workspace owner is pinned to (account-pins.js); an AI Proxy brings its
   // own key, and an empty pool leaves the machine's login in charge.
   // A real login (kind `login`) is written into a MEMBER's home by place();
   // a setup-token goes in as CLAUDE_CODE_OAUTH_TOKEN.
   const poolAccount =
     entry.launcher === "claude" && !proxyProfile
-      ? require("./claude-pool").forSpawn(require("./run-as").accountForLane(laneId))
+      ? require("./claude-pool").forSpawn(require("./run-as").accountForLane(laneId), laneOwner)
       : null;
   // Codex likewise, from its own pool (codex-pool.js): an API key through
   // `-e`, or a ChatGPT login written into the member's CODEX_HOME by place().
   const codexPool =
     entry.launcher === "codex" && !proxyProfile
-      ? require("./codex-pool").forSpawn(require("./run-as").accountForLane(laneId))
+      ? require("./codex-pool").forSpawn(require("./run-as").accountForLane(laneId), laneOwner)
       : null;
   const paneCred = require("./auth").newPaneToken();
   if (forkSession === true) {