feat(desktop): drop parked review flow, add publish management

SaaS 侧人工审核后才创建 publish job，desktop 不再做二次审核：移除
manual/waiting_user/parked/from_parked 状态机与 LeaseFromParked 查询，
desktop client 只执行发布并新增"发布管理"页（待发布队列 / 历史 / 再次
发送）。同时抽离 @geo/publisher-platforms 共享适配器包、新增 Redis-based
desktop_presence 与 publish_record_support，刷新 admin-web 发布弹窗与
媒体库；plan A / spec 文档同步口径。

server/internal/tenant/repository/generated/desktop_client.sql.go

@@ -11,6 +11,42 @@ import (
 	"github.com/jackc/pgx/v5/pgtype"
 )
 
+const getDesktopClientByID = `-- name: GetDesktopClientByID :one
+SELECT id, tenant_id, workspace_id, user_id, token_hash, device_name, os, cpu_arch, client_version, channel, created_at, last_seen_at, last_rotated_at, revoked_at
+FROM desktop_clients
+WHERE id = $1
+  AND workspace_id = $2
+  AND revoked_at IS NULL
+LIMIT 1
+`
+
+type GetDesktopClientByIDParams struct {
+	ID          pgtype.UUID `json:"id"`
+	WorkspaceID int64       `json:"workspace_id"`
+}
+
+func (q *Queries) GetDesktopClientByID(ctx context.Context, arg GetDesktopClientByIDParams) (DesktopClient, error) {
+	row := q.db.QueryRow(ctx, getDesktopClientByID, arg.ID, arg.WorkspaceID)
+	var i DesktopClient
+	err := row.Scan(
+		&i.ID,
+		&i.TenantID,
+		&i.WorkspaceID,
+		&i.UserID,
+		&i.TokenHash,
+		&i.DeviceName,
+		&i.Os,
+		&i.CpuArch,
+		&i.ClientVersion,
+		&i.Channel,
+		&i.CreatedAt,
+		&i.LastSeenAt,
+		&i.LastRotatedAt,
+		&i.RevokedAt,
+	)
+	return i, err
+}
+
 const getDesktopClientByTokenHash = `-- name: GetDesktopClientByTokenHash :one
 SELECT id, tenant_id, workspace_id, user_id, token_hash, device_name, os, cpu_arch, client_version, channel, created_at, last_seen_at, last_rotated_at, revoked_at
 FROM desktop_clients
@@ -163,6 +199,19 @@ VALUES (
     $9,
     $10
 )
+ON CONFLICT (id) DO UPDATE
+SET tenant_id = EXCLUDED.tenant_id,
+    workspace_id = EXCLUDED.workspace_id,
+    user_id = EXCLUDED.user_id,
+    token_hash = EXCLUDED.token_hash,
+    device_name = EXCLUDED.device_name,
+    os = EXCLUDED.os,
+    cpu_arch = EXCLUDED.cpu_arch,
+    client_version = EXCLUDED.client_version,
+    channel = EXCLUDED.channel,
+    last_seen_at = now(),
+    last_rotated_at = now(),
+    revoked_at = NULL
 RETURNING id, tenant_id, workspace_id, user_id, token_hash, device_name, os, cpu_arch, client_version, channel, created_at, last_seen_at, last_rotated_at, revoked_at
 `