feat(publish-dedup): reject duplicate publish jobs and expose target task ids

Build a per-target dedup_key (tenant/workspace/article/platform/account) on
publish job creation, take an xact advisory lock on the keys, look up
already-active publish_records via the payload index, and skip creating
duplicate desktop_tasks. Surface created vs existing task ids on
CreatePublishJobResponse (and shared-types) so callers can tell the
difference, return `desktop_publish_duplicate` on unique-constraint races,
and expose desktop_account_id on PublishRecordResponse so the modal can
disable already-published accounts. Make the compliance ack consumer
accept a nullable job id since the dedup short-circuit no longer creates
one.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/shared-types/src/index.ts

@@ -405,8 +405,12 @@ export interface CreatePublishJobRequest {
 }
 
 export interface CreatePublishJobResponse {
+  /** Empty when all requested targets were already covered by existing publish tasks. */
   job_id: string
+  /** Target-ordered union of created_task_ids and existing_task_ids. */
   task_ids: string[]
+  created_task_ids: string[]
+  existing_task_ids: string[]
 }
 
 export interface WorkspaceOverview {
@@ -991,6 +995,7 @@ export interface PublishRecord {
   publish_batch_id: number
   article_id: number
   platform_account_id: number
+  desktop_account_id: string | null
   platform_id: string
   platform_name: string
   platform_nickname: string