feat(desktop): isolate platform accounts per desktop client

Scope desktop media accounts by the authenticated desktop client_id so
the same user logging in from Mac and Windows no longer sees a shared
account list. The list, identity lookup, upsert, patch, tombstone and
async health sink paths now all require matching client_id, and the
active uniqueness index moves from (workspace, platform, uid) to
(workspace, client, platform, uid).

Also strengthen the desktop client_id seed: when the OS machine id is
unavailable, fall back to a hashed fingerprint of stable hardware MAC
addresses before the random installation id, so the same hardware
keeps the same client across reinstalls.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/repository/generated/desktop_account.sql.go

@@ -192,16 +192,18 @@ SELECT
     updated_at
 FROM platform_accounts
 WHERE workspace_id = $1
-  AND platform_id = $2
-  AND platform_uid = $3
+  AND client_id = $2
+  AND platform_id = $3
+  AND platform_uid = $4
   AND deleted_at IS NULL
 LIMIT 1
 `
 
 type GetDesktopAccountByIdentityParams struct {
-	WorkspaceID int64  `json:"workspace_id"`
-	PlatformID  string `json:"platform_id"`
-	PlatformUid string `json:"platform_uid"`
+	WorkspaceID int64       `json:"workspace_id"`
+	ClientID    pgtype.UUID `json:"client_id"`
+	PlatformID  string      `json:"platform_id"`
+	PlatformUid string      `json:"platform_uid"`
 }
 
 type GetDesktopAccountByIdentityRow struct {
@@ -226,7 +228,12 @@ type GetDesktopAccountByIdentityRow struct {
 }
 
 func (q *Queries) GetDesktopAccountByIdentity(ctx context.Context, arg GetDesktopAccountByIdentityParams) (GetDesktopAccountByIdentityRow, error) {
-	row := q.db.QueryRow(ctx, getDesktopAccountByIdentity, arg.WorkspaceID, arg.PlatformID, arg.PlatformUid)
+	row := q.db.QueryRow(ctx, getDesktopAccountByIdentity,
+		arg.WorkspaceID,
+		arg.ClientID,
+		arg.PlatformID,
+		arg.PlatformUid,
+	)
 	var i GetDesktopAccountByIdentityRow
 	err := row.Scan(
 		&i.DesktopID,
@@ -251,6 +258,98 @@ func (q *Queries) GetDesktopAccountByIdentity(ctx context.Context, arg GetDeskto
 	return i, err
 }
 
+const listDesktopAccountsByClient = `-- name: ListDesktopAccountsByClient :many
+SELECT
+    desktop_id,
+    tenant_id,
+    workspace_id,
+    user_id,
+    client_id,
+    platform_id,
+    platform_uid,
+    account_fingerprint,
+    display_name,
+    avatar_url,
+    health,
+    verified_at,
+    tags,
+    sync_version,
+    deleted_at,
+    delete_requested_at,
+    created_at,
+    updated_at
+FROM platform_accounts
+WHERE workspace_id = $1
+  AND client_id = $2
+  AND deleted_at IS NULL
+ORDER BY platform_id, display_name, created_at DESC
+`
+
+type ListDesktopAccountsByClientParams struct {
+	WorkspaceID int64       `json:"workspace_id"`
+	ClientID    pgtype.UUID `json:"client_id"`
+}
+
+type ListDesktopAccountsByClientRow struct {
+	DesktopID          pgtype.UUID        `json:"desktop_id"`
+	TenantID           int64              `json:"tenant_id"`
+	WorkspaceID        int64              `json:"workspace_id"`
+	UserID             int64              `json:"user_id"`
+	ClientID           pgtype.UUID        `json:"client_id"`
+	PlatformID         string             `json:"platform_id"`
+	PlatformUid        string             `json:"platform_uid"`
+	AccountFingerprint pgtype.Text        `json:"account_fingerprint"`
+	DisplayName        string             `json:"display_name"`
+	AvatarUrl          pgtype.Text        `json:"avatar_url"`
+	Health             string             `json:"health"`
+	VerifiedAt         pgtype.Timestamptz `json:"verified_at"`
+	Tags               []byte             `json:"tags"`
+	SyncVersion        int64              `json:"sync_version"`
+	DeletedAt          pgtype.Timestamptz `json:"deleted_at"`
+	DeleteRequestedAt  pgtype.Timestamptz `json:"delete_requested_at"`
+	CreatedAt          pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt          pgtype.Timestamptz `json:"updated_at"`
+}
+
+func (q *Queries) ListDesktopAccountsByClient(ctx context.Context, arg ListDesktopAccountsByClientParams) ([]ListDesktopAccountsByClientRow, error) {
+	rows, err := q.db.Query(ctx, listDesktopAccountsByClient, arg.WorkspaceID, arg.ClientID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []ListDesktopAccountsByClientRow
+	for rows.Next() {
+		var i ListDesktopAccountsByClientRow
+		if err := rows.Scan(
+			&i.DesktopID,
+			&i.TenantID,
+			&i.WorkspaceID,
+			&i.UserID,
+			&i.ClientID,
+			&i.PlatformID,
+			&i.PlatformUid,
+			&i.AccountFingerprint,
+			&i.DisplayName,
+			&i.AvatarUrl,
+			&i.Health,
+			&i.VerifiedAt,
+			&i.Tags,
+			&i.SyncVersion,
+			&i.DeletedAt,
+			&i.DeleteRequestedAt,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const listDesktopAccountsByUser = `-- name: ListDesktopAccountsByUser :many
 SELECT
     desktop_id,
@@ -437,7 +536,8 @@ SET display_name = COALESCE($1::text, display_name),
     updated_at = now()
 WHERE desktop_id = $6
   AND workspace_id = $7
-  AND sync_version = $8
+  AND client_id = $8
+  AND sync_version = $9
   AND deleted_at IS NULL
 RETURNING
     desktop_id,
@@ -468,6 +568,7 @@ type PatchDesktopAccountParams struct {
 	Tags          []byte             `json:"tags"`
 	DesktopID     pgtype.UUID        `json:"desktop_id"`
 	WorkspaceID   int64              `json:"workspace_id"`
+	ClientID      pgtype.UUID        `json:"client_id"`
 	IfSyncVersion int64              `json:"if_sync_version"`
 }
 
@@ -501,6 +602,7 @@ func (q *Queries) PatchDesktopAccount(ctx context.Context, arg PatchDesktopAccou
 		arg.Tags,
 		arg.DesktopID,
 		arg.WorkspaceID,
+		arg.ClientID,
 		arg.IfSyncVersion,
 	)
 	var i PatchDesktopAccountRow
@@ -534,7 +636,8 @@ SET deleted_at = now(),
     updated_at = now()
 WHERE desktop_id = $1
   AND workspace_id = $2
-  AND sync_version = $3
+  AND client_id = $3
+  AND sync_version = $4
   AND deleted_at IS NULL
 RETURNING
     desktop_id,
@@ -560,6 +663,7 @@ RETURNING
 type TombstoneDesktopAccountParams struct {
 	DesktopID     pgtype.UUID `json:"desktop_id"`
 	WorkspaceID   int64       `json:"workspace_id"`
+	ClientID      pgtype.UUID `json:"client_id"`
 	IfSyncVersion int64       `json:"if_sync_version"`
 }
 
@@ -585,7 +689,12 @@ type TombstoneDesktopAccountRow struct {
 }
 
 func (q *Queries) TombstoneDesktopAccount(ctx context.Context, arg TombstoneDesktopAccountParams) (TombstoneDesktopAccountRow, error) {
-	row := q.db.QueryRow(ctx, tombstoneDesktopAccount, arg.DesktopID, arg.WorkspaceID, arg.IfSyncVersion)
+	row := q.db.QueryRow(ctx, tombstoneDesktopAccount,
+		arg.DesktopID,
+		arg.WorkspaceID,
+		arg.ClientID,
+		arg.IfSyncVersion,
+	)
 	var i TombstoneDesktopAccountRow
 	err := row.Scan(
 		&i.DesktopID,
@@ -651,7 +760,7 @@ VALUES (
     $15,
     1
 )
-ON CONFLICT (workspace_id, platform_id, platform_uid) WHERE deleted_at IS NULL
+ON CONFLICT (workspace_id, client_id, platform_id, platform_uid) WHERE deleted_at IS NULL
 DO UPDATE SET
     client_id = EXCLUDED.client_id,
     user_id = EXCLUDED.user_id,
@@ -669,6 +778,7 @@ DO UPDATE SET
     delete_requested_at = NULL,
     updated_at = now()
 WHERE platform_accounts.workspace_id = EXCLUDED.workspace_id
+  AND platform_accounts.client_id = EXCLUDED.client_id
   AND (
     $16::bigint IS NULL
     OR platform_accounts.sync_version = $16::bigint