feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

package.json

@@ -1,13 +1,23 @@
 {
   "name": "geo-rankly",
   "private": true,
-  "packageManager": "pnpm@10.28.2",
+  "packageManager": "pnpm@10.33.0+sha512.10568bb4a6afb58c9eb3630da90cc9516417abebd3fabbe6739f0ae795728da1491e9db5a544c76ad8eb7570f5c4bb3d6c637b2cb41bfdcdb47fa823c8649319",
   "scripts": {
     "dev:admin": "pnpm --filter admin-web dev",
     "build:admin": "pnpm --filter admin-web build",
     "typecheck:admin": "pnpm --filter admin-web typecheck",
+    "dev:desktop": "pnpm --filter @geo/desktop-client dev",
+    "build:desktop": "pnpm --filter @geo/desktop-client build",
+    "typecheck:desktop": "pnpm --filter @geo/desktop-client typecheck",
     "dev:extension": "pnpm --filter browser-extension dev",
     "build:extension": "pnpm --filter browser-extension build",
     "typecheck:extension": "pnpm --filter browser-extension exec vue-tsc --noEmit"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "better-sqlite3",
+      "electron",
+      "esbuild"
+    ]
   }
 }