feat: opt-in keep-warm for idle accounts + per-account pin endpoint (#76)

[MagicalTux]

Implements #76: keep idle accounts' 5-hour session timers running so the next account isn't cold when rotation reaches it.

Why

The rolling 5h window only starts on real usage. So when the active account runs out and rotation moves to a cold account, that account's 5h window starts then — right when you need its full headroom. Keep-warm starts the timer ahead of time.

What

• src/warmer.js — opt-in Warmer (mirrors Prober). On an interval, for each eligible idle account it spawns a minimal one-shot claude -p --bare --model haiku "hi" pointed at this proxy, pinned to that account. Warms only healthy, idle, Anthropic OAuth accounts whose 5h window is not already running (skips disabled/throttled/errored + third-party backends) and uses the cheapest model, to keep the cost minimal. Injectable spawnFn for tests; per-account status via getStatus().
• src/server.js — account-pin routing. A request to /tc-acct/<name-or-index>/... is forced onto that one account, no rotation and no failover; the prefix is stripped before forwarding. resolveAccountPin() exported for tests. This is what the warmer uses, and it doubles as a manual way to target one account.
• src/index.js — wire the Warmer (start/stop/reschedule/status), gated on config.warmupSeconds (default 0 = off); teamclaude warmup <off|secs> CLI, live-reschedulable.

⚠️ This is a deliberate departure from passive-only

The quota probe is a zero-spend usage read. Keep-warm is different: the 5h timer cannot be started by a read-only call, so it sends a real (minimal) message and therefore spends a little quota (a few tokens + a slice of the 5h/weekly buckets per account per window). That's why it's strictly opt-in, window-aware, and cheapest-model. prober.js's "one sanctioned active feature" note is updated to reflect there are now two.

Manual test

ANTHROPIC_BASE_URL='http://127.0.0.1:3456/tc-acct/1' \
ANTHROPIC_API_KEY='<teamclaude proxy key>' \
  claude -p --bare 'say hi'
# → routed only to account index 1; that account's 5h timer starts

Tests

account-pin.test.js (resolver + end-to-end routing, prefix strip, 404, rotation override) and warmer.test.js (eligibility, spawn spec, status, error paths, scheduling). 180 tests pass, lint clean.

Note for review

Unit/integration tests fully cover the pin routing and the warmer's decision/spawn logic, but CI can't exercise the real claude --bare subprocess end-to-end (no live accounts). I verified the CLI flags exist (--bare, -p, --model, --output-format); a live smoke test against a running server is worth doing before relying on it.

Closes #76

🤖 Generated with Claude Code