feat(tenant-api): add desktop content asset endpoint scoped by tenant

Lets desktop clients fetch tenant images/articles assets via Bearer-auth
without requiring the public asset signature, so stale-signed assets
served from existing articles still load on the desktop side.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/transport/router.go

@@ -46,6 +46,7 @@ func RegisterRoutes(app *bootstrap.App) {
 	desktopAuth.GET("/dispatch", desktopDispatchHandler.Dispatch)
 	desktopAuth.GET("/accounts", desktopAccountHandler.List)
 	desktopAuth.GET("/content/articles/:id", desktopContentHandler.Article)
+	desktopAuth.GET("/content/assets/:token", publicAssets.ServeDesktop)
 	desktopAuth.GET("/publish-tasks", desktopTaskHandler.ListPublish)
 	desktopAuth.POST("/accounts", desktopAccountHandler.Upsert)
 	desktopAuth.PATCH("/accounts/:id", desktopAccountHandler.Patch)