feat(desktop): isolate platform accounts per desktop client

Scope desktop media accounts by the authenticated desktop client_id so
the same user logging in from Mac and Windows no longer sees a shared
account list. The list, identity lookup, upsert, patch, tombstone and
async health sink paths now all require matching client_id, and the
active uniqueness index moves from (workspace, platform, uid) to
(workspace, client, platform, uid).

Also strengthen the desktop client_id seed: when the OS machine id is
unavailable, fall back to a hashed fingerprint of stable hardware MAC
addresses before the random installation id, so the same hardware
keeps the same client across reinstalls.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/migrations/20260506120000_scope_platform_accounts_to_desktop_client.down.sql

@@ -0,0 +1,5 @@
+DROP INDEX IF EXISTS uniq_platform_accounts_workspace_identity_active;
+
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_platform_accounts_workspace_identity_active
+    ON platform_accounts (workspace_id, platform_id, platform_uid)
+    WHERE deleted_at IS NULL;

server/migrations/20260506120000_scope_platform_accounts_to_desktop_client.up.sql

@@ -0,0 +1,5 @@
+DROP INDEX IF EXISTS uniq_platform_accounts_workspace_identity_active;
+
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_platform_accounts_workspace_identity_active
+    ON platform_accounts (workspace_id, client_id, platform_id, platform_uid)
+    WHERE deleted_at IS NULL;