feat(tenant-api): add desktop content asset endpoint scoped by tenant

Lets desktop clients fetch tenant images/articles assets via Bearer-auth
without requiring the public asset signature, so stale-signed assets
served from existing articles still load on the desktop side.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/transport/router_test.go

@@ -77,6 +77,7 @@ func TestDesktopClientRoutes_ClientTokenAuth(t *testing.T) {
 	}{
 		{http.MethodGet, "/api/desktop/dispatch"},
 		{http.MethodGet, "/api/desktop/accounts"},
+		{http.MethodGet, "/api/desktop/content/assets/:token"},
 		{http.MethodPost, "/api/desktop/clients/offline"},
 		{http.MethodPost, "/api/desktop/tasks/lease"},
 		{http.MethodPost, "/api/desktop/tasks/:id/result"},