fix(web): pin/unpin requests send X-OpenForge-UI header

[SymbolStar]

Bug

Scott reported: thread message 页面中 file pin to top 不 work.

Root cause

_pinRef / _unpinRef in web/app.js use bare fetch() instead of apiJson(), so they never send the X-OpenForge-UI: 1 header. The server's _resolve_speaker guard treats actor='scott' without that header as a spoofing attempt and returns 403:

{"error": "posting as 'scott' is reserved for the OpenForge UI; agents must use their own agent id as speaker"}

UI catches the !ok and shows a generic pin 失败 toast.

Fix

Add X-OpenForge-UI: 1 to both the POST (pin) and DELETE (unpin) calls. Matches the pattern in apiJson() and other UI mutating calls.

Verify

# before (no header) → 403
curl -sX POST .../pinned-refs -H 'Content-Type: application/json' -d '{"ref_id":"ref_X","actor":"scott"}'
# {"error": "posting as 'scott' is reserved ..."}

# with header → 201
curl -sX POST .../pinned-refs -H 'Content-Type: application/json' -H 'X-OpenForge-UI: 1' -d '{"ref_id":"ref_X","actor":"scott"}'
# {"thread_id": "...", "pinned_ref": {...}, "pinned_refs": [...]}

Reproduced & verified against the running 7878 server.

[github-actions]

🤖 bot-review (comment-only · phase 1)

Diff: 1 file changed, 2 insertions(+), 2 deletions(-) @ af8af4c

Red-line checks:

• ✅ A-7.5: no new 'forbidden' code in xiaof

---

Phase 2: auto-approve + auto-merge fire only when red-lines are clean, author is internal, and no needs-human path is touched. Block with no-auto-merge label or [no-auto-merge] in title.

[github-actions]

✅ Auto-approved by bot-review: red-line checks clean, internal author, no needs-human paths.

[github-actions]

✅ Auto-approved by bot-review: red-line checks clean, internal author, no needs-human paths.