fix(desktop-task): drop LEFT JOIN in lease query so FOR UPDATE locks only desktop_tasks

Postgres rejects FOR UPDATE on the nullable side of a LEFT JOIN, which
made LeaseNextQueuedDesktopTask fail under contention. Replace the join
with a NOT EXISTS subquery, scope the row lock to the dt alias, and add
a regression test plus warn-level logging on lease query failures so
similar issues are easier to diagnose.

server/internal/tenant/app/desktop_task_service.go

@@ -223,6 +223,16 @@ func (s *DesktopTaskService) Lease(ctx context.Context, client *repository.Deskt
 			}
 			return nil, s.classifyLeaseError(ctx, client, taskID)
 		}
+		fields := []zap.Field{
+			zap.String("client_id", client.ID.String()),
+		}
+		if req.Kind != nil {
+			fields = append(fields, zap.String("requested_kind", strings.TrimSpace(*req.Kind)))
+		}
+		if taskID != nil {
+			fields = append(fields, zap.String("task_id", taskID.String()))
+		}
+		s.logWarn("desktop task lease query failed", err, fields...)
 		return nil, response.ErrInternal(50088, "desktop_task_lease_failed", "failed to lease desktop task")
 	}