feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

apps/desktop-client/src/renderer/App.vue

@@ -0,0 +1,18 @@
+<script setup lang="ts">
+import { onMounted } from "vue";
+
+import DesktopShell from "./components/DesktopShell.vue";
+import { useDesktopSession } from "./composables/useDesktopSession";
+import LoginView from "./views/LoginView.vue";
+
+const { isAuthenticated, syncRuntimeSession } = useDesktopSession();
+
+onMounted(() => {
+  void syncRuntimeSession();
+});
+</script>
+
+<template>
+  <DesktopShell v-if="isAuthenticated" />
+  <LoginView v-else />
+</template>