feat(monitoring): fail same-client queued tasks on desktop authorization failure

When a desktop monitoring task fails with a non-retryable authorization failure
(login expired, challenge required, risk control), all pending same-client/same-platform
tasks for the same business day are immediately bulk-failed as non-retryable, avoiding
wasted execution attempts. Adds preflight authorization checks before task execution,
enriches failure payloads with disposition metadata (code, category, retryable flags),
and triggers account health reports on auth state degradation.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

server/internal/tenant/app/desktop_task_service.go

@@ -20,7 +20,6 @@ import (
 	"github.com/geo-platform/tenant-api/internal/shared/config"
 	"github.com/geo-platform/tenant-api/internal/shared/messaging/rabbitmq"
 	"github.com/geo-platform/tenant-api/internal/shared/response"
-	"github.com/geo-platform/tenant-api/internal/shared/stream"
 	tenantcompliance "github.com/geo-platform/tenant-api/internal/tenant/compliance"
 	"github.com/geo-platform/tenant-api/internal/tenant/repository"
 )
@@ -702,6 +701,10 @@ func (s *DesktopTaskService) Complete(ctx context.Context, client *repository.De
 	if err != nil {
 		return nil, err
 	}
+	bulkFailure, err := bulkFailQueuedDesktopTasksForAuthorizationFailure(ctx, tx, task, errorJSON)
+	if err != nil {
+		return nil, err
+	}
 
 	if err := tx.Commit(ctx); err != nil {
 		return nil, response.ErrInternal(50104, "desktop_task_complete_commit_failed", "failed to commit desktop task completion")
@@ -713,8 +716,19 @@ func (s *DesktopTaskService) Complete(ctx context.Context, client *repository.De
 			s.logWarn("monitoring article alias sync failed after publish complete", syncErr, zap.Int64("article_id", publishOutcome.ArticleID))
 		}
 	}
+	for _, outcome := range bulkFailure.PublishOutcomes {
+		invalidateArticleCaches(ctx, s.cache, outcome.TenantID, &outcome.ArticleID)
+		if outcome.ArticleAlias != nil {
+			if syncErr := s.syncMonitoringArticleAlias(ctx, outcome.ArticleAlias); syncErr != nil {
+				s.logWarn("monitoring article alias sync failed after bulk authorization failure", syncErr, zap.Int64("article_id", outcome.ArticleID))
+			}
+		}
+	}
 
 	s.publishTaskEvent(ctx, task, "task_completed")
+	for _, failedTask := range bulkFailure.Tasks {
+		s.publishTaskEvent(ctx, failedTask, "task_completed")
+	}
 
 	view := buildDesktopTaskView(task)
 	return &view, nil
@@ -1760,56 +1774,7 @@ func requeuePreemptedMonitorTask(
 }
 
 func (s *DesktopTaskService) publishTaskEvent(ctx context.Context, task *repository.DesktopTask, eventType string) {
-	if task == nil {
-		return
-	}
-
-	title, businessDate, schedulerGroupKey, questionText := deriveDesktopTaskEventMetadataFromPayload(task.Kind, task.Payload)
-	event := DesktopTaskEvent{
-		Type:                eventType,
-		TaskID:              task.DesktopID.String(),
-		JobID:               task.JobID.String(),
-		WorkspaceID:         task.WorkspaceID,
-		TargetAccountID:     task.TargetAccountID.String(),
-		TargetClientID:      task.TargetClientID.String(),
-		Platform:            task.Platform,
-		Title:               title,
-		BusinessDate:        businessDate,
-		SchedulerGroupKey:   schedulerGroupKey,
-		QuestionText:        questionText,
-		Status:              task.Status,
-		Kind:                task.Kind,
-		Priority:            task.Priority,
-		Lane:                task.Lane,
-		InterruptGeneration: task.InterruptGeneration,
-		UpdatedAt:           task.UpdatedAt,
-	}
-	err := publishDesktopTaskEvent(ctx, s.messaging, event)
-	if err != nil {
-		s.logWarn("desktop task event publish failed", err, zap.String("task_id", task.DesktopID.String()), zap.String("event_type", eventType))
-	}
-
-	if dispatchErr := publishDesktopDispatchEvent(ctx, s.messaging, s.logger, stream.DesktopDispatchEvent{
-		Type:                event.Type,
-		TaskID:              event.TaskID,
-		JobID:               event.JobID,
-		WorkspaceID:         event.WorkspaceID,
-		TargetAccountID:     event.TargetAccountID,
-		TargetClientID:      event.TargetClientID,
-		Platform:            event.Platform,
-		Title:               event.Title,
-		BusinessDate:        event.BusinessDate,
-		SchedulerGroupKey:   event.SchedulerGroupKey,
-		QuestionText:        event.QuestionText,
-		Status:              event.Status,
-		Kind:                event.Kind,
-		Priority:            event.Priority,
-		Lane:                event.Lane,
-		InterruptGeneration: event.InterruptGeneration,
-		UpdatedAt:           event.UpdatedAt,
-	}); dispatchErr != nil {
-		s.logWarn("desktop dispatch mirror publish failed", dispatchErr, zap.String("task_id", task.DesktopID.String()), zap.String("event_type", eventType))
-	}
+	publishDesktopTaskLifecycleEvent(ctx, s.messaging, s.logger, task, eventType)
 }
 
 func (s *DesktopTaskService) logWarn(message string, err error, fields ...zap.Field) {