feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

server/internal/shared/auth/claims.go

@@ -5,8 +5,9 @@ import (
 )
 
 type Claims struct {
-	UserID   int64  `json:"user_id"`
-	TenantID int64  `json:"tenant_id"`
-	Role     string `json:"role"`
+	UserID             int64  `json:"user_id"`
+	TenantID           int64  `json:"tenant_id"`
+	PrimaryWorkspaceID int64  `json:"primary_workspace_id"`
+	Role               string `json:"role"`
 	jwt.RegisteredClaims
 }

server/internal/shared/auth/context.go

@@ -3,9 +3,10 @@ package auth
 import "context"
 
 type Actor struct {
-	UserID   int64
-	TenantID int64
-	Role     string
+	UserID             int64
+	TenantID           int64
+	PrimaryWorkspaceID int64
+	Role               string
 }
 
 type actorKey struct{}

server/internal/shared/auth/context_test.go

@@ -8,7 +8,7 @@ import (
 )
 
 func TestWithActorAndFromCtx(t *testing.T) {
-	actor := Actor{UserID: 1, TenantID: 10, Role: "editor"}
+	actor := Actor{UserID: 1, TenantID: 10, PrimaryWorkspaceID: 100, Role: "editor"}
 	ctx := WithActor(context.Background(), actor)
 
 	got, ok := ActorFromCtx(ctx)
@@ -28,9 +28,22 @@ func TestMustActorPanics(t *testing.T) {
 }
 
 func TestMustActorReturns(t *testing.T) {
-	actor := Actor{UserID: 5, TenantID: 20, Role: "tenant_admin"}
+	actor := Actor{UserID: 5, TenantID: 20, PrimaryWorkspaceID: 200, Role: "tenant_admin"}
 	ctx := WithActor(context.Background(), actor)
 
 	got := MustActor(ctx)
 	assert.Equal(t, actor, got)
 }
+
+func TestActorCarriesPrimaryWorkspaceID(t *testing.T) {
+	ctx := WithActor(context.Background(), Actor{
+		UserID:             10,
+		TenantID:           20,
+		PrimaryWorkspaceID: 30,
+		Role:               "member",
+	})
+
+	actor, ok := ActorFromCtx(ctx)
+	assert.True(t, ok)
+	assert.Equal(t, int64(30), actor.PrimaryWorkspaceID)
+}

server/internal/shared/auth/jwt.go

@@ -31,15 +31,16 @@ type TokenPair struct {
 	ExpiresAt    int64  `json:"expires_at"`
 }
 
-func (m *Manager) Issue(userID, tenantID int64, role string) (*TokenPair, error) {
+func (m *Manager) Issue(userID, tenantID, primaryWorkspaceID int64, role string) (*TokenPair, error) {
 	now := time.Now()
 	accessJTI := uuid.New().String()
 	refreshJTI := uuid.New().String()
 
 	accessClaims := Claims{
-		UserID:   userID,
-		TenantID: tenantID,
-		Role:     role,
+		UserID:             userID,
+		TenantID:           tenantID,
+		PrimaryWorkspaceID: primaryWorkspaceID,
+		Role:               role,
 		RegisteredClaims: jwt.RegisteredClaims{
 			ID:        accessJTI,
 			Subject:   "access",
@@ -53,9 +54,10 @@ func (m *Manager) Issue(userID, tenantID int64, role string) (*TokenPair, error)
 	}
 
 	refreshClaims := Claims{
-		UserID:   userID,
-		TenantID: tenantID,
-		Role:     role,
+		UserID:             userID,
+		TenantID:           tenantID,
+		PrimaryWorkspaceID: primaryWorkspaceID,
+		Role:               role,
 		RegisteredClaims: jwt.RegisteredClaims{
 			ID:        refreshJTI,
 			Subject:   "refresh",

server/internal/shared/auth/jwt_test.go

@@ -11,7 +11,7 @@ import (
 func TestIssueAndParse(t *testing.T) {
 	mgr := NewManager("test-secret-key", 15*time.Minute, 7*24*time.Hour)
 
-	pair, err := mgr.Issue(42, 10, "tenant_admin")
+	pair, err := mgr.Issue(42, 10, 100, "tenant_admin")
 	require.NoError(t, err)
 	assert.NotEmpty(t, pair.AccessToken)
 	assert.NotEmpty(t, pair.RefreshToken)
@@ -23,6 +23,7 @@ func TestIssueAndParse(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, int64(42), claims.UserID)
 	assert.Equal(t, int64(10), claims.TenantID)
+	assert.Equal(t, int64(100), claims.PrimaryWorkspaceID)
 	assert.Equal(t, "tenant_admin", claims.Role)
 	assert.Equal(t, "access", claims.Subject)
 	assert.Equal(t, pair.AccessJTI, claims.ID)
@@ -31,7 +32,7 @@ func TestIssueAndParse(t *testing.T) {
 func TestParseRefreshToken(t *testing.T) {
 	mgr := NewManager("test-secret-key", 15*time.Minute, 7*24*time.Hour)
 
-	pair, err := mgr.Issue(1, 1, "viewer")
+	pair, err := mgr.Issue(1, 1, 10, "viewer")
 	require.NoError(t, err)
 
 	claims, err := mgr.Parse(pair.RefreshToken)
@@ -43,7 +44,7 @@ func TestParseRefreshToken(t *testing.T) {
 func TestParseExpired(t *testing.T) {
 	mgr := NewManager("test-secret-key", -1*time.Second, -1*time.Second)
 
-	pair, err := mgr.Issue(1, 1, "viewer")
+	pair, err := mgr.Issue(1, 1, 10, "viewer")
 	require.NoError(t, err)
 
 	_, err = mgr.Parse(pair.AccessToken)
@@ -54,7 +55,7 @@ func TestParseWrongSecret(t *testing.T) {
 	mgr1 := NewManager("secret-one", 15*time.Minute, 7*24*time.Hour)
 	mgr2 := NewManager("secret-two", 15*time.Minute, 7*24*time.Hour)
 
-	pair, err := mgr1.Issue(1, 1, "viewer")
+	pair, err := mgr1.Issue(1, 1, 10, "viewer")
 	require.NoError(t, err)
 
 	_, err = mgr2.Parse(pair.AccessToken)

server/internal/shared/auth/middleware.go

@@ -87,9 +87,10 @@ func Middleware(jwtMgr *Manager, sessions *SessionStore) gin.HandlerFunc {
 		}
 
 		actor := Actor{
-			UserID:   claims.UserID,
-			TenantID: claims.TenantID,
-			Role:     claims.Role,
+			UserID:             claims.UserID,
+			TenantID:           claims.TenantID,
+			PrimaryWorkspaceID: claims.PrimaryWorkspaceID,
+			Role:               claims.Role,
 		}
 		c.Request = c.Request.WithContext(WithActor(c.Request.Context(), actor))
 		c.Next()

server/internal/shared/auth/middleware_test.go

@@ -30,7 +30,7 @@ func setupTestMiddleware(t *testing.T) (*Manager, *SessionStore, *miniredis.Mini
 func TestAuthMiddleware_ValidToken(t *testing.T) {
 	mgr, sessions, _ := setupTestMiddleware(t)
 
-	pair, err := mgr.Issue(1, 10, "editor")
+	pair, err := mgr.Issue(1, 10, 100, "editor")
 	require.NoError(t, err)
 
 	r := gin.New()
@@ -52,6 +52,7 @@ func TestAuthMiddleware_ValidToken(t *testing.T) {
 	assert.Equal(t, http.StatusOK, w.Code)
 	assert.Equal(t, int64(1), gotActor.UserID)
 	assert.Equal(t, int64(10), gotActor.TenantID)
+	assert.Equal(t, int64(100), gotActor.PrimaryWorkspaceID)
 	assert.Equal(t, "editor", gotActor.Role)
 }
 
@@ -87,7 +88,7 @@ func TestAuthMiddleware_InvalidToken(t *testing.T) {
 func TestAuthMiddleware_RefreshTokenRejected(t *testing.T) {
 	mgr, sessions, _ := setupTestMiddleware(t)
 
-	pair, err := mgr.Issue(1, 10, "editor")
+	pair, err := mgr.Issue(1, 10, 100, "editor")
 	require.NoError(t, err)
 
 	r := gin.New()
@@ -105,7 +106,7 @@ func TestAuthMiddleware_RefreshTokenRejected(t *testing.T) {
 func TestAuthMiddleware_BlacklistedToken(t *testing.T) {
 	mgr, sessions, mr := setupTestMiddleware(t)
 
-	pair, err := mgr.Issue(1, 10, "editor")
+	pair, err := mgr.Issue(1, 10, 100, "editor")
 	require.NoError(t, err)
 
 	// Blacklist the access token's JTI

server/internal/shared/config/config.go

@@ -77,6 +77,7 @@ type RabbitMQConfig struct {
 	GenerationDLQ                string `mapstructure:"generation_dlq"`
 	GenerationDLQRouteKey        string `mapstructure:"generation_dlq_routing_key"`
 	GenerationEventExchange      string `mapstructure:"generation_event_exchange"`
+	DesktopTaskEventExchange     string `mapstructure:"desktop_task_event_exchange"`
 	TemplateAssistExchange       string `mapstructure:"template_assist_exchange"`
 	TemplateAssistRoutingKey     string `mapstructure:"template_assist_routing_key"`
 	TemplateAssistQueue          string `mapstructure:"template_assist_queue"`
@@ -471,6 +472,9 @@ func normalizeRabbitMQConfig(cfg *RabbitMQConfig) {
 	if strings.TrimSpace(cfg.GenerationEventExchange) == "" {
 		cfg.GenerationEventExchange = "generation.event"
 	}
+	if strings.TrimSpace(cfg.DesktopTaskEventExchange) == "" {
+		cfg.DesktopTaskEventExchange = "desktop.task.event"
+	}
 	if strings.TrimSpace(cfg.TemplateAssistExchange) == "" {
 		cfg.TemplateAssistExchange = "template.assist"
 	}

server/internal/shared/messaging/rabbitmq/client.go

@@ -98,6 +98,10 @@ func (c *Client) PublishGenerationEvent(ctx context.Context, body []byte) error
 	return c.publishFanout(ctx, c.cfg.GenerationEventExchange, body)
 }
 
+func (c *Client) PublishDesktopTaskEvent(ctx context.Context, body []byte) error {
+	return c.publishFanout(ctx, c.cfg.DesktopTaskEventExchange, body)
+}
+
 func (c *Client) PublishTemplateAssistTask(ctx context.Context, body []byte) error {
 	return c.publish(ctx, c.cfg.TemplateAssistExchange, c.cfg.TemplateAssistRoutingKey, body)
 }
@@ -180,6 +184,10 @@ func (c *Client) ConsumeGenerationEvents(consumerName string) (<-chan amqp.Deliv
 	return c.consumeFanout(consumerName, c.cfg.GenerationEventExchange)
 }
 
+func (c *Client) ConsumeDesktopTaskEvents(consumerName string) (<-chan amqp.Delivery, *amqp.Channel, error) {
+	return c.consumeFanout(consumerName, c.cfg.DesktopTaskEventExchange)
+}
+
 func (c *Client) ConsumeTemplateAssistTask(consumerName string) (<-chan amqp.Delivery, *amqp.Channel, error) {
 	return c.consume(consumerName, c.cfg.TemplateAssistQueue)
 }
@@ -558,6 +566,18 @@ func (c *Client) ensureTopology(conn *amqp.Connection) error {
 		return fmt.Errorf("declare rabbitmq exchange %s: %w", c.cfg.GenerationEventExchange, err)
 	}
 
+	if err := ch.ExchangeDeclare(
+		c.cfg.DesktopTaskEventExchange,
+		"fanout",
+		false,
+		false,
+		false,
+		false,
+		nil,
+	); err != nil {
+		return fmt.Errorf("declare rabbitmq exchange %s: %w", c.cfg.DesktopTaskEventExchange, err)
+	}
+
 	if err := c.ensureWorkQueue(
 		ch,
 		c.cfg.TemplateAssistExchange,

server/internal/shared/middleware/logger_test.go

@@ -36,7 +36,7 @@ func TestLoggerIncludesDetailedAuthFailureContext(t *testing.T) {
 	mgr := sharedauth.NewManager("logger-test-secret", -1*time.Minute, 7*24*time.Hour)
 	sessions := sharedauth.NewSessionStore(rdb)
 
-	pair, err := mgr.Issue(7, 42, "editor")
+	pair, err := mgr.Issue(7, 42, 420, "editor")
 	require.NoError(t, err)
 
 	router := gin.New()

server/internal/shared/stream/desktop.go

@@ -0,0 +1,158 @@
+package stream
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"sync"
+	"time"
+
+	"github.com/geo-platform/tenant-api/internal/shared/messaging/rabbitmq"
+)
+
+type DesktopTaskEvent struct {
+	Type           string    `json:"type"`
+	TaskID         string    `json:"task_id"`
+	JobID          string    `json:"job_id"`
+	WorkspaceID    int64     `json:"workspace_id"`
+	TargetClientID string    `json:"target_client_id"`
+	Status         string    `json:"status"`
+	Kind           string    `json:"kind"`
+	UpdatedAt      time.Time `json:"updated_at"`
+}
+
+type desktopClientStream struct {
+	subscribers    map[int]chan DesktopTaskEvent
+	nextSubscriber int
+}
+
+type DesktopTaskHub struct {
+	mu           sync.Mutex
+	streams      map[string]*desktopClientStream
+	rabbitMQ     *rabbitmq.Client
+	instanceID   string
+	consumerName string
+}
+
+func NewDesktopTaskHub(rabbitMQClient *rabbitmq.Client) *DesktopTaskHub {
+	instanceID := fmt.Sprintf("%d-%d", os.Getpid(), time.Now().UnixNano())
+	return &DesktopTaskHub{
+		streams:      make(map[string]*desktopClientStream),
+		rabbitMQ:     rabbitMQClient,
+		instanceID:   instanceID,
+		consumerName: "desktop-task-stream-" + instanceID,
+	}
+}
+
+func (h *DesktopTaskHub) Run(ctx context.Context) {
+	if h == nil || h.rabbitMQ == nil {
+		return
+	}
+	go h.run(ctx)
+}
+
+func (h *DesktopTaskHub) Publish(event DesktopTaskEvent) {
+	if h == nil || event.TargetClientID == "" {
+		return
+	}
+
+	h.mu.Lock()
+	stream := h.ensureLocked(event.TargetClientID)
+	subscribers := make([]chan DesktopTaskEvent, 0, len(stream.subscribers))
+	for _, subscriber := range stream.subscribers {
+		subscribers = append(subscribers, subscriber)
+	}
+	h.mu.Unlock()
+
+	for _, subscriber := range subscribers {
+		select {
+		case subscriber <- event:
+		default:
+		}
+	}
+}
+
+func (h *DesktopTaskHub) Subscribe(clientID string) (<-chan DesktopTaskEvent, func()) {
+	if h == nil || clientID == "" {
+		return nil, func() {}
+	}
+
+	h.mu.Lock()
+	stream := h.ensureLocked(clientID)
+	subscriberID := stream.nextSubscriber
+	stream.nextSubscriber++
+
+	ch := make(chan DesktopTaskEvent, 64)
+	stream.subscribers[subscriberID] = ch
+	h.mu.Unlock()
+
+	cancel := func() {
+		h.mu.Lock()
+		defer h.mu.Unlock()
+
+		current := h.streams[clientID]
+		if current == nil {
+			close(ch)
+			return
+		}
+
+		delete(current.subscribers, subscriberID)
+		if len(current.subscribers) == 0 {
+			delete(h.streams, clientID)
+		}
+		close(ch)
+	}
+
+	return ch, cancel
+}
+
+func (h *DesktopTaskHub) run(ctx context.Context) {
+	for {
+		deliveries, ch, err := h.rabbitMQ.ConsumeDesktopTaskEvents(h.consumerName)
+		if err != nil {
+			select {
+			case <-ctx.Done():
+				return
+			case <-time.After(2 * time.Second):
+				continue
+			}
+		}
+
+		closed := false
+		for !closed {
+			select {
+			case <-ctx.Done():
+				_ = ch.Close()
+				return
+			case delivery, ok := <-deliveries:
+				if !ok {
+					closed = true
+					continue
+				}
+				h.handleDelivery(delivery.Body)
+				_ = delivery.Ack(false)
+			}
+		}
+		_ = ch.Close()
+	}
+}
+
+func (h *DesktopTaskHub) handleDelivery(body []byte) {
+	var event DesktopTaskEvent
+	if err := json.Unmarshal(body, &event); err != nil {
+		return
+	}
+	h.Publish(event)
+}
+
+func (h *DesktopTaskHub) ensureLocked(clientID string) *desktopClientStream {
+	stream := h.streams[clientID]
+	if stream == nil {
+		stream = &desktopClientStream{
+			subscribers: make(map[int]chan DesktopTaskEvent),
+		}
+		h.streams[clientID] = stream
+	}
+	return stream
+}