feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

apps/desktop-client/src/main/tray.ts

@@ -0,0 +1,27 @@
+import { nativeImage } from "electron/common";
+import { Menu, Tray } from "electron/main";
+import type { Tray as ElectronTray } from "electron/main";
+
+let tray: ElectronTray | null = null;
+
+function createFallbackIcon() {
+  return nativeImage.createEmpty();
+}
+
+export function initTray(onOpen: () => void): ElectronTray {
+  if (tray) {
+    return tray;
+  }
+
+  tray = new Tray(createFallbackIcon());
+  tray.setToolTip("GEO Rankly Desktop");
+  tray.setContextMenu(
+    Menu.buildFromTemplate([
+      { label: "Open", click: () => onOpen() },
+      { type: "separator" },
+      { role: "quit", label: "Quit" },
+    ]),
+  );
+  tray.on("click", () => onOpen());
+  return tray;
+}