feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

server/internal/bootstrap/bootstrap.go

@@ -46,6 +46,7 @@ type App struct {
 	ObjectStorage     objectstorage.Client
 	AuditLogs         *auditlog.AsyncWriter
 	GenerationStreams *stream.GenerationHub
+	DesktopTaskStreams *stream.DesktopTaskHub
 	Cache             cache.Cache
 	KolProfiles       repository.KolProfileRepository
 	KolPackages       repository.KolPackageRepository
@@ -109,6 +110,7 @@ func New(configPath string) (*App, error) {
 	objectStorageClient := objectstorage.New(cfg.ObjectStorage, logger)
 	auditLogs := auditlog.NewAsyncWriter(pool, logger)
 	generationStreams := stream.NewGenerationHub(mqClient)
+	desktopTaskStreams := stream.NewDesktopTaskHub(mqClient)
 	appCache := cache.New(cfg.Cache.Driver, rdb)
 	kolProfiles := repository.NewKolProfileRepository(pool)
 	kolPackages := repository.NewKolPackageRepository(pool)
@@ -169,6 +171,7 @@ func New(configPath string) (*App, error) {
 		ObjectStorage:     objectStorageClient,
 		AuditLogs:         auditLogs,
 		GenerationStreams: generationStreams,
+		DesktopTaskStreams: desktopTaskStreams,
 		Cache:             appCache,
 		KolProfiles:       kolProfiles,
 		KolPackages:       kolPackages,