[Feature]: Prevent pinned threads from auto-settling

Problem

A sidebar pin (pinnedAt) is an explicit keep-active signal, but the server currently auto-settles pinned threads anyway:

• isAutoSettlementCandidate in apps/server/src/orchestration/ThreadSettlementPolicy.ts never checks pinnedAt, so pinned threads are swept for both inactivity and merged/closed-PR settlement.
• decider.ts thread.auto-settle has no pinned guard — it even emits a companion thread.unpinned event, silently dropping the user's pin.
• Docs (docs/user/thread-sidebar.md) state: "Pinning does not prevent automatic settlement."

The existing ThreadSettlementPolicy.test.ts case is even named "blocks pins, ..." but only covers settledOverride: 'active' (the transient keep-active override), not the sidebar pin.

Related:

• #5575 (durable never-settle override — closed, different primitive: settledOverride vs sidebar pinnedAt)
• #7969 (moved auto-settled pinned threads into Settled — the behavior this reverses for auto-settle; manual settle still unpins and lands in Settled)

Proposal

• isAutoSettlementCandidate returns false when pinnedAt != null (covers inactivity + PR paths, skips PR lookups).
• thread.auto-settle decider rejects when pinnedAt != null (stale-sweep race: pin landed after the snapshot), while thread.settle (manual) still succeeds and clears the pin.
• Docs updated: pinning prevents automatic settlement.

Acceptance

• Inactive pinned thread never auto-settles
• Merged/closed-PR pinned thread never auto-settles
• Unpinning re-arms normal auto-settle rules
• Manual settle of a pinned thread still works and unpins

Start with apps/server/src/orchestration/ThreadSettlementPolicy.ts and ThreadSettlementPolicy.test.ts, then inspect the thread.auto-settle decider and docs/user/thread-sidebar.md. Verify the policy and decider both respect pinnedAt while manual thread.settle still unpins and succeeds. Add coverage for inactivity, merged or closed PRs, unpinning, and the stale-sweep race, and update the documentation wording.