Add Account Pool settings UI with Claude sign-in

[SawyerHood]

Stack layer 4 of 4 (top). Prerequisites: #3035, #3036, and #3042 below it in this stack.

Human comments

What was wrong

Account Pool had no settings UI or interactive Claude login path, so users had to provision accounts through the CLI. The plugin could also report needs-configuration when empty, but the app frontend loader discarded every plugin frontend outside running; that made the configuration UI that an empty pool needs impossible to load. Part of #1552.

What changed

• Added an Account Pool settings section with the minimal account list, ready/held/exhausted/error/disabled status, 5-hour and 7-day percentages, enable/disable, confirmed removal, machine import, and a password-field API-key flow.
• Added Claude Code-compatible PKCE login with a ten-minute in-memory session, manual callback paste parsing, state validation, token exchange, profile enrichment, protected account storage, and user-readable errors that do not expose upstream payloads.
• Exposed login through typed plugin RPC and two plugin-owned CLI commands: bb pool account add --provider claude --login prints the authorization URL and session ID, then bb pool account login-complete --session <id> --code-stdin completes it without putting the pasted code in process arguments.
• Generalized the plugin CLI proxy's protected stdin handling so any --<name>-stdin flag becomes --<name> <single-line-value> with the existing 16 KiB limit; core contains no Account Pool-specific routing.
• Published account mutation notifications and refreshed the settings list after mutations.
• Allowed frontend bundles for needs-configuration and degraded plugins, with regression coverage for all supported settings statuses.
• Updated the plugin guide, built-in bb CLI skill, and configuration documentation. There is no server/host-daemon wire change, so HOST_DAEMON_PROTOCOL_VERSION is unchanged.

How you verified

• pnpm exec turbo run typecheck test --filter=bb-plugin-account-pool --filter=@bb/cli --filter=@bb/app --filter=@bb/templates --continue --force — 14/14 tasks passed: Account Pool 28 tests, CLI 530 tests, app 3,853 tests (4 skipped), templates 43 tests.
• pnpm --silent bb plugin build plugins/account-pool — emitted server and app JS/CSS/meta bundles.
• pnpm install --frozen-lockfile --offline — lockfile accepted without resolution changes.
• Live dev-app proof: captured the empty state, started the PKCE/manual-paste flow, verified the API-key input is type=password, imported the machine OAuth account, ran Claude Code thread thr_qr935hirfw to an ok response through the pool, observed 5-hour/7-day utilization, removed the account in the UI, and confirmed its mode-600 secret file was deleted. Screenshots and command artifacts are attached to BB-92.
• The isolated headless QA browser reached Claude's Cloudflare “Performing security verification” page, so live OAuth completion stopped at the brief's human-browser boundary. The exact state is attached; successful exchange/profile/storage and all three paste shapes are covered against fake HTTP servers.

Part of #1552

AGENT GENERATED