feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

apps/admin-web/src/lib/api.ts

@@ -869,28 +869,32 @@ export const brandsApi = {
 
 export const mediaApi = {
   platforms() {
-    return apiClient.get<MediaPlatform[]>("/api/tenant/media/platforms");
+    return removedMediaApi<MediaPlatform[]>("platforms");
   },
   accounts() {
-    return apiClient.get<PlatformAccount[]>("/api/tenant/media/platform-accounts");
+    return removedMediaApi<PlatformAccount[]>("accounts");
   },
   createPluginSession(payload: CreatePluginSessionRequest) {
-    return apiClient.post<CreatePluginSessionResponse, CreatePluginSessionRequest>(
-      "/api/tenant/media/plugin-sessions",
-      payload,
-    );
+    void payload;
+    return removedMediaApi<CreatePluginSessionResponse>("create_plugin_session");
   },
   registerPluginInstallation(payload: RegisterPluginInstallationRequest) {
-    return apiClient.post<RegisterPluginInstallationResponse, RegisterPluginInstallationRequest>(
-      "/api/tenant/media/plugin-installations/register",
-      payload,
-    );
+    void payload;
+    return removedMediaApi<RegisterPluginInstallationResponse>("register_plugin_installation");
   },
   unbindAccount(id: number) {
-    return apiClient.remove<null>(`/api/tenant/media/platform-accounts/${id}`);
+    void id;
+    return removedMediaApi<null>("unbind_account");
   },
 };
 
+function removedMediaApi<T>(action: string): Promise<T> {
+  return Promise.reject(new ApiClientError({
+    message: "desktop_media_api_removed",
+    detail: `legacy media API action "${action}" has been removed; use desktop client accounts and publish jobs instead`,
+  }));
+}
+
 export const monitoringApi = {
   dashboardComposite(params: {
     brand_id?: number;