feat: sync task pins with PostHog

[tatoalo]

Problem

Task pins are currently stored per device, so they cannot be recovered when a user signs back in elsewhere.

Why: The pinned-task sidebar should reflect the authenticated user, not a particular installation or browser profile.

Changes

• add API client methods for reading and setting user task pins.
• make unpin writes idempotent.

Depends on PostHog/posthog#74595

[trunk-io]

😎 Merged successfully - details.

[github-actions]

React Doctor could not produce a report.

_{Reviewed by React Doctor for commit d54dfbb.}

[greptile-apps]

Prompt To Fix All With AI

### Issue 1
packages/ui/src/features/sidebar/usePinnedTasks.ts:11-15
**Pins cache crosses identities**

When a user logs out, changes projects, or switches organizations, this static query remains cached because it lacks authentication-scoped metadata and an authentication guard. The sidebar therefore displays the previous identity's pins, or the unauthenticated empty result, for up to the 30-second stale period.

### Issue 2
packages/ui/src/features/sidebar/taskMetaApi.ts:57-61
**Concurrent toggles collapse**

When the same task is toggled twice before the first GET-and-POST sequence finishes, both operations can read the same initial pin state and write the same value. Two user actions then produce only one persisted toggle, leaving the server state inconsistent with the user's final action.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix: route sidebar pins through PostHog" | Re-trigger Greptile}

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 1 · PR risk: 0/10