feat(desktop): drop parked review flow, add publish management

SaaS 侧人工审核后才创建 publish job，desktop 不再做二次审核：移除
manual/waiting_user/parked/from_parked 状态机与 LeaseFromParked 查询，
desktop client 只执行发布并新增"发布管理"页（待发布队列 / 历史 / 再次
发送）。同时抽离 @geo/publisher-platforms 共享适配器包、新增 Redis-based
desktop_presence 与 publish_record_support，刷新 admin-web 发布弹窗与
媒体库；plan A / spec 文档同步口径。

server/internal/tenant/repository/queries/desktop_client.sql

@@ -23,6 +23,19 @@ VALUES (
     sqlc.narg(client_version),
     sqlc.narg(channel)
 )
+ON CONFLICT (id) DO UPDATE
+SET tenant_id = EXCLUDED.tenant_id,
+    workspace_id = EXCLUDED.workspace_id,
+    user_id = EXCLUDED.user_id,
+    token_hash = EXCLUDED.token_hash,
+    device_name = EXCLUDED.device_name,
+    os = EXCLUDED.os,
+    cpu_arch = EXCLUDED.cpu_arch,
+    client_version = EXCLUDED.client_version,
+    channel = EXCLUDED.channel,
+    last_seen_at = now(),
+    last_rotated_at = now(),
+    revoked_at = NULL
 RETURNING *;
 
 -- name: GetDesktopClientByTokenHash :one
@@ -32,6 +45,14 @@ WHERE token_hash = sqlc.arg(token_hash)
   AND revoked_at IS NULL
 LIMIT 1;
 
+-- name: GetDesktopClientByID :one
+SELECT *
+FROM desktop_clients
+WHERE id = sqlc.arg(id)
+  AND workspace_id = sqlc.arg(workspace_id)
+  AND revoked_at IS NULL
+LIMIT 1;
+
 -- name: RotateDesktopClientToken :one
 UPDATE desktop_clients
 SET token_hash = sqlc.arg(token_hash),