feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

apps/desktop-client/src/main/tracing/recorder.ts

@@ -0,0 +1,13 @@
+export interface TraceRecord {
+  type: string;
+  createdAt: number;
+  payload: Record<string, unknown>;
+}
+
+export function createTraceRecord(type: string, payload: Record<string, unknown>): TraceRecord {
+  return {
+    type,
+    createdAt: Date.now(),
+    payload,
+  };
+}

apps/desktop-client/src/main/tracing/redactor.ts

@@ -0,0 +1,10 @@
+const redactKeys = new Set(["authorization", "cookie", "password", "token"]);
+
+export function redactPayload(payload: Record<string, unknown>): Record<string, unknown> {
+  return Object.fromEntries(
+    Object.entries(payload).map(([key, value]) => [
+      key,
+      redactKeys.has(key.toLowerCase()) ? "[REDACTED]" : value,
+    ]),
+  );
+}

apps/desktop-client/src/main/tracing/trace-writer.ts

@@ -0,0 +1,5 @@
+import type { TraceRecord } from "./recorder";
+
+export function serializeTrace(records: TraceRecord[]): string {
+  return JSON.stringify(records, null, 2);
+}