feat(desktop): add monitor scheduler, Playwright CDP layer, and account health

Move monitor-task scheduling authority onto the client with a durable
file-backed queue that survives restart, drops stale cross-day tasks,
enforces per-platform serialism, and adapts global concurrency from
Electron process metrics. Publish tasks keep their existing FIFO.

Add a hidden Playwright CDP manager that attaches to Electron Chromium
on account session partitions, lets adapters opt into `executionMode:
"playwright"`, and leaves the existing hidden WebContentsView path in
place for current adapters.

Introduce an account-health subsystem with silent probes, projected
health/auth states, and IPC invalidation events so the renderer can
show accurate auth/probe status and verification timestamps.

Server-side, derive and forward title/business_date/scheduler_group_key/
question_text metadata on desktop task events so the local scheduler
can defer same-question fan-out before leasing.

findings.md

@@ -4,6 +4,7 @@
 - Verify the repository against the 9-step implementation plan provided by the user.
 - Use `/Users/liangxu/Documents/test/geo-rankly/docs/superpowers/specs/2026-03-31-admin-web-backend-core-design.md` as the source of truth for the next development slice.
 - Continue development immediately after identifying the earliest unfinished step.
+- For desktop AI monitoring, put scheduling authority on the client, keep scraping silent/background-only, allow stale cross-day tasks to be dropped, and avoid fanning one question to all models at once.
 
 ## Research Findings
 - The repository already contains core backend scaffolding under `server/`, including `cmd/tenant-api`, `internal/bootstrap`, `shared`, `tenant`, `migrations`, and SQL query files.
@@ -62,6 +63,22 @@
 - `template_prompt.go`, `template_assist.go`, `prompt_generate_service.go`, and `knowledge_service.go` now assemble prompts from the centralized prompt package, so runtime business logic no longer embeds the long prompt text directly.
 - The prompt centralization also corrected invalid JSON quoting in the seed card config `custom_placeholder` fields, which previously contained unescaped inner quotes.
 - Targeted verification passed with `go test ./internal/tenant/... ./cmd/dev-seed` from `server/`, confirming the refactor compiles cleanly across the affected runtime and seed paths.
+- `desktop-client` now includes an AI platform management view with all six target platforms and the existing bind/open/unbind flows wired through the desktop bridge.
+- `account-binder.ts` already supports all six AI platforms through generic binding definitions, but identity detection is heuristic and not yet platform-specific.
+- The current desktop runtime executes tasks through a simple in-memory FIFO guarded by a single `currentTaskId`, so all desktop tasks are effectively global-serial today.
+- Monitor-task dropping by `business_date` is already implemented in the runtime controller; stale tasks are returned as `unknown` with a client-drop reason instead of being retried on the next day.
+- There is currently no durable local monitor-task queue/cache in `desktop-client`; if the process exits, queued work only survives on the server side.
+- `process-metrics.ts` already samples Electron process CPU and memory, which gives us enough local telemetry to drive a small adaptive-concurrency policy without introducing a new metrics dependency.
+- `session-registry.ts` already persists per-account Electron session partitions to `desktop-session-partitions.json`, showing that lightweight file-backed persistence is already accepted in this runtime.
+- The only implemented monitor adapter is `doubao`, and it still uses the existing hidden `WebContentsView` path rather than Playwright.
+- `playwright-core` is installed in `apps/desktop-client`, but there is no `connectOverCDP()` runtime integration yet.
+- Hidden execution primitives already exist in two forms: hidden `BrowserWindow` instances for silent account checks and pooled hidden `WebContentsView` instances for existing adapters.
+- Runtime diagnostics already expose scheduler and process-metrics state through the desktop snapshot, so new scheduler/CDP fields can be surfaced without inventing a new renderer path.
+- A new local monitor scheduler now persists queued monitor tasks to `app.getPath("userData")/desktop-monitor-scheduler.json`, recovers same-day tasks after restart, and drops stale cross-day tasks during hydration.
+- The new scheduler is intentionally conservative when a task has no question-level metadata: unknown-question monitor tasks do not consume the second concurrency slot, which avoids accidental same-question fan-out until server event metadata is available.
+- Electron process metrics are sufficient to drive a two-tier adaptive concurrency policy: default to `1`, raise to `2` only when the machine looks healthy enough and multiple live AI accounts exist.
+- Desktop task SSE events now carry optional `business_date`, `scheduler_group_key`, `question_text`, and `title` metadata derived from the task payload, allowing the local scheduler to defer same-question fan-out before leasing.
+- A new hidden Playwright manager now connects to Electron Chromium through a local CDP endpoint and leases hidden pages bound to the existing account session partition, while leaving the legacy hidden-view path available for current adapters.
 
 ## Technical Decisions
 | Decision | Rationale |
@@ -78,6 +95,9 @@
 | Introduce a minimal `vue-i18n` foundation now instead of leaving hard-coded strings in new pages | The user explicitly called out the current i18n approach as non-standard |
 | Keep `AppShell.vue` on the user-preferred version and avoid structural/style rewrites there | The user said that file is managed elsewhere and only allowed inline-style cleanup |
 | Create a dedicated `internal/tenant/prompts` package for prompt text and seed definitions | This keeps prompt tuning in one place while minimizing refactor risk in the current dirty worktree |
+| Add the local scheduler before wiring more monitor adapters | This aligns with the user's requirement that the client, not the server, decides actual execution timing |
+| Keep publish-task execution behavior intact while evolving monitor-task scheduling | Publish is already working and should not be destabilized by monitor-specific policy changes |
+| Build the hidden Playwright layer as reusable infrastructure instead of burying it inside one adapter | Qwen is the immediate motivation, but the same layer will likely be needed by other complex AI platforms |
 
 ## Issues Encountered
 | Issue | Resolution |
@@ -86,6 +106,7 @@
 | `make sqlc-generate` fails before any code is generated | Repair the `sqlc.yaml` schema path and then build repository wrappers around generated queries |
 | `go run` migrate initially failed with `unknown driver postgres` | Added `-tags postgres` to the Makefile-managed migrate command |
 | Playwright MCP could not open a browser session locally because it tried to create `/.playwright-mcp` | Use `vite preview` plus `curl` verification for this turn instead of spending time on browser tool plumbing |
+| `desktop-client` has no existing SQLite/local DB layer despite `better-sqlite3` being installed | Decide between a tiny file-backed queue or adding a new DB-backed task store during implementation |
 
 ## Resources
 - `/Users/liangxu/Documents/test/geo-rankly/docs/superpowers/specs/2026-03-31-admin-web-backend-core-design.md`