feat(kiloclaw): Add user self-pinning UI and admin improvements

[St0rmz1]

feat(kiloclaw): Add user self pinning UI and admin improvements

• User facing tRPC endpoints (listAvailableVersions, getMyPin, setMyPin, removeMyPin)
• VersionPinCard component in Settings tab
• React hooks for version/pin queries and mutations
• Admin UI: reason visibility warning for end users
• Fix TOCTOU race in admin disable-latest guard with check-update-recheck
• Make kilocodeDefaultModel nullable/optional in provision schema
• 13 tests covering CRUD, authorization, and validation

[kilo-code-bot]

Code Review Summary

Status: No New Issues Found | Recommendation: Merge (after addressing previously flagged items)

Overview

Re-reviewed all 7 changed files after latest push. All previously flagged issues (merge conflicts, duplicate imports, missing validations, PII leaks, unnecessary transactions) have been addressed in the latest commits. The code is well-structured with:

• ✅ Proper Zod input validation with max(500) on reason strings
• ✅ Admin-pin guard preventing users from overwriting admin-set pins
• ✅ Atomic removeMyPin using WHERE pinned_by = user_id (no TOCTOU)
• ✅ getMyPin avoids joining user table to prevent admin email leakage
• ✅ GDPR compliance — kiloclaw_version_pins already handled in softDeleteUser
• ✅ Comprehensive test coverage (336-line test file covering CRUD, authorization, admin-pin guards)
• ✅ Frontend maxLength={500} matching backend validation
• ✅ Admin UI now warns "Reason is visible to the end user"
• ✅ Double-check pattern in updateVersionStatus with rollback on race condition

Remaining Acknowledged Concerns

Area	Status	Notes
setMyPin TOCTOU on admin-pin guard	Acknowledged	The check-then-upsert at lines 562–595 has a small race window. Could be fixed atomically by adding a where clause to onConflictDoUpdate (e.g., where: eq(pinned_by, ctx.user.id)). Low risk given the narrow window and non-critical impact.
updateVersionStatus disable window	Acknowledged	Brief window where version is disabled before re-verify + rollback. Acceptable for admin-only operation.

Files Reviewed (7 files)

• src/app/(app)/claw/components/SettingsTab.tsx — imports + renders VersionPinCard
• src/app/(app)/claw/components/VersionPinCard.tsx — new user-facing version pin UI (237 lines)
• src/app/admin/components/KiloclawInstances/KiloclawInstanceDetail.tsx — admin UI layout + "reason visible" warning
• src/app/admin/components/KiloclawVersions/KiloclawVersionsPage.tsx — admin pins tab layout + "reason visible" warning
• src/hooks/useKiloClaw.ts — new hooks for user pin queries/mutations
• src/routers/admin-kiloclaw-versions-router.ts — double-check pattern for disable with rollback
• src/routers/kiloclaw-router.ts — user version pinning endpoints (listAvailableVersions, getMyPin, setMyPin, removeMyPin)
• src/routers/kiloclaw-user-versions-router.test.ts — comprehensive test suite (336 lines)