MCP `pins`: list, pin and unpin the caller's pinned repositories, with the same rules as the API #4798

Intent: the repositories a person keeps at hand are the same in the harness as on the page.

Done:

• [ ] src/http/mcp.ts has a pins tool, placed right after board_pins, taking action (list | pin | unpin) and repo. It calls what GET /api/v1/user/pins and PUT/DELETE /api/v1/user/pins/:owner/:name call, for the caller only
• [ ] a repository the caller cannot see is refused as not found
• [ ] docs/MCP.md has its row beside board_pins
• [ ] test/mcp-pins.test.ts: a person pins, lists and unpins; pinning a private repository they cannot see is not found; a read-only token is refused pin and unpin when the API refuses it

Risks: test/mcp-size.test.ts holds tools/list under a 37,000-byte headroom, so keep the description to one short sentence. Other MCP tools are being added in parallel, so put this one exactly where named so the hunks do not meet. Do not change the API routes: the tool calls the same functions.

Ready again: pull #4817 was closed because main moved under it and it could not be brought up to date. Conflicting files: docs/MCP.md, src/http/mcp.ts.

Parked by the crew: the preview's deploy failed and the decider saw no point in another try (pull #6035 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.