By default a per-model engine pin is a hard constraint: if the pinned
engine is down/incompatible the request fails (no duplicate on another
card). Add an `engine_fallback` model-config flag (admin form checkbox +
persisted in models.json) that opts into the old behaviour — fall back to
a compatible engine when the pin can't be honoured. A pinned engine
that's merely busy-but-alive is still routed to (queues) in both modes;
fallback only applies when it's actually down or can't serve the model.

Threads pin_fallback through pick_engine; the front reads engine_fallback
via _load_pins/_model_info.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>