feat(desktop): isolate platform accounts per desktop client

Scope desktop media accounts by the authenticated desktop client_id so
the same user logging in from Mac and Windows no longer sees a shared
account list. The list, identity lookup, upsert, patch, tombstone and
async health sink paths now all require matching client_id, and the
active uniqueness index moves from (workspace, platform, uid) to
(workspace, client, platform, uid).

Also strengthen the desktop client_id seed: when the OS machine id is
unavailable, fall back to a hashed fingerprint of stable hardware MAC
addresses before the random installation id, so the same hardware
keeps the same client across reinstalls.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/transport/desktop_account_handler.go

@@ -34,7 +34,7 @@ func (h *DesktopAccountHandler) List(c *gin.Context) {
 		return
 	}
 
-	data, err := h.svc.ListByUser(c.Request.Context(), MustDesktopClient(c.Request.Context()))
+	data, err := h.svc.ListByClient(c.Request.Context(), MustDesktopClient(c.Request.Context()))
 	if err != nil {
 		response.Error(c, err)
 		return