feat(pinning): add user-scoped /api/pinning/unpin action

[humanoidrobot-glitch]

Summary

The pinning dispatcher (api/pinning/[action].js) exposes pin and status actions but had no way to remove a pin. Pinata's unpin HTTP endpoint was reachable from the client-side src/pinning/pinata.js library but had no caller, and the backend had no equivalent surface, so users had no way to release pinned manifests / GLBs they no longer cared about. CIDs accumulate on the Pinata account indefinitely.

What's added

A new unpin action mirroring the existing pin shape:

POST /api/pinning?action=unpin   { cid }

• Auth: session or bearer (same as pin).
• Rate limit: reuses the existing limits.pinUser preset (30/h).
• Scope: looks up the pin in the pins table scoped to the caller's user_id so users can only unpin their own pins.
• Provider routing:
  • provider = 'pinata' → calls Pinata DELETE /pinning/unpin/:cid. Treats Pinata 404 as idempotent success (pin already gone).
  • provider = 'web3.storage' → drops the local row only. web3.storage has no first-class unpin endpoint; pins age out via their own lifecycle.
  • Anything else → 400 validation_error.
• On success, deletes the row from pins and returns { ok: true, cid, provider }.

Why not auto-unpin on agent delete

The original audit suggestion was "call unpin() on agent deletion." That requires linking pins to agents, but the current pins table has only user_id — no agent_id column. Adding that column is a schema change flagged as must-ask-first in api/CLAUDE.md.

This PR ships the missing API capability without speculation. A follow-up can wire it into the agent-delete flow or a UI control once the linkage design is decided.

Test plan

• node --check api/pinning/[action].js passes.
• POST /api/pinning?action=unpin with { cid: "<owned cid>" } → 200, row deleted from pins, Pinata DELETE called.
• Same call but the cid belongs to a different user → 404.
• Pinata returns 404 on a stale cid → still 200 (idempotent).
• cid missing or non-alphanumeric → 400 validation_error.
• Unauthenticated → 401.
• Rate-limit: 31 calls in an hour → 429 on the 31st.
• No PINATA_JWT env set + provider=pinata row → 503 pinning_unconfigured.