feat(compliance): add content compliance detection across tenant, ops, and clients

Implements the Revision 8/9 compliance design: tenant + ops backends, ops-web
content-safety pages, admin-web editor/publish gate integration, desktop publish
block surfacing, and supporting migrations / shared types / config plumbing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/transport/desktop_task_handler.go

@@ -22,17 +22,19 @@ type DesktopTaskHandler struct {
 
 func NewDesktopTaskHandler(a *bootstrap.App) *DesktopTaskHandler {
 	return &DesktopTaskHandler{
-		svc: app.NewDesktopTaskService(
+		svc: app.NewDesktopTaskServiceWithConfig(
 			a.DB,
 			a.MonitoringDB,
 			a.RabbitMQ,
 			a.Logger,
+			a.ConfigStore,
 		).WithCache(a.Cache).WithRedis(a.Redis),
-		publishSvc: app.NewPublishJobService(
+		publishSvc: app.NewPublishJobServiceWithConfig(
 			a.DB,
 			a.RabbitMQ,
 			a.Redis,
 			a.Logger,
+			a.ConfigStore,
 		).WithCache(a.Cache),
 	}
 }