feat(desktop): isolate platform accounts per desktop client

Scope desktop media accounts by the authenticated desktop client_id so
the same user logging in from Mac and Windows no longer sees a shared
account list. The list, identity lookup, upsert, patch, tombstone and
async health sink paths now all require matching client_id, and the
active uniqueness index moves from (workspace, platform, uid) to
(workspace, client, platform, uid).

Also strengthen the desktop client_id seed: when the OS machine id is
unavailable, fall back to a hashed fingerprint of stable hardware MAC
addresses before the random installation id, so the same hardware
keeps the same client across reinstalls.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/desktop-client/src/main/device-id.test.ts

@@ -0,0 +1,54 @@
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('electron/main', () => ({
+  app: {
+    getPath: () => '/tmp/geo-rankly-test-user-data',
+  },
+}))
+
+import { resolveDesktopClientID } from './device-id'
+
+describe('desktop device client id', () => {
+  it('is stable for the same hardware and account scope', () => {
+    const scope = {
+      tenant_id: 1,
+      workspace_id: 2,
+      user_id: 3,
+    }
+
+    expect(resolveDesktopClientID(scope)).toBe(resolveDesktopClientID(scope))
+  })
+
+  it('keeps different account scopes separate on the same hardware', () => {
+    const base = resolveDesktopClientID({
+      tenant_id: 1,
+      workspace_id: 2,
+      user_id: 3,
+    })
+
+    expect(
+      resolveDesktopClientID({
+        tenant_id: 1,
+        workspace_id: 2,
+        user_id: 4,
+      }),
+    ).not.toBe(base)
+    expect(
+      resolveDesktopClientID({
+        tenant_id: 1,
+        workspace_id: 5,
+        user_id: 3,
+      }),
+    ).not.toBe(base)
+  })
+
+  it('rejects missing account scope instead of generating a random id', () => {
+    expect(() =>
+      resolveDesktopClientID({
+        tenant_id: 1,
+        workspace_id: 0,
+        user_id: 3,
+      }),
+    ).toThrow('desktop_client_id_scope_invalid')
+  })
+})