fix(virtual-mcp): drop pinned views for detached connections

[pedrofrxncx]

Problem

A pinned view whose connection is no longer aggregated on the agent renders a tab that cannot be removed.

Reported on farmrio / agent vir_H62GklSGy4YowOaV06okW ("Visual Merchandising"): a PLP optimizer tab pointing at conn_4xFJaZfgju0VCZSH4quts, which is not in connection_aggregations for that agent. The settings panel lists only attached connections, so it rendered no toggle for it — but the tab bar renders straight from metadata.ui.pinnedViews, orphan included.

The existing orphan reconcile in layout-tab-content.tsx didn't catch it: it only drops a pin whose connection fetched OK but no longer exposes the tool. A detached connection is never fetched, so fetchedOkIds.has(...) is false and the pin is kept — forever.

Fix

keepAttachedPinnedViews() — drop pins whose connectionId isn't among the agent's attached connections. Applied in two places:

• use-main-panel-tabs.ts — the tab disappears immediately, no visit to settings required.
• layout-tab-content.tsx — the reconcile now persists the prune.

An empty attached-connection list means "not loaded yet" and keeps everything, so the bar never blanks mid-load. Pins for attached connections that fail to fetch are still kept, preserving the transient-error guard.

Testing

• apps/web/src/layouts/main-panel-tabs/attached-pinned-views.test.ts — 3 cases: detached dropped, loading keeps all, attached-but-erroring kept.
• Prod row for vir_H62GklSGy4YowOaV06okW was manually corrected (orphan removed from metadata.ui.pinnedViews, 4 → 3) so the customer is unblocked; this PR prevents recurrence and cleans up any other org's orphans on next agent load.

Not in scope

metadata.ui.homeTiles / homeTile have the same orphan class and are not pruned by cleanOrphanedPinnedViews in apps/api/src/storage/virtual.ts either. No reported breakage, left for a follow-up.

---

Summary by cubic

Fixes unremovable pinned tabs when a pinned view's connection is no longer attached to the agent.

Bug Fixes

• Filters pinned views against the agent's attached connections in both the tab bar and the settings reconcile.
• An empty attached-connection list means "not loaded yet" and keeps everything, so the tab bar never blanks mid-load.
• Keeps pins for attached connections that fail to fetch, preserving the transient-error guard.
• Existing orphans are pruned on the next agent load; the reported row was already corrected manually.

^{Written for commit dc8b356. Summary will update on new commits.}