feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

server/internal/shared/auth/context_test.go

@@ -8,7 +8,7 @@ import (
 )
 
 func TestWithActorAndFromCtx(t *testing.T) {
-	actor := Actor{UserID: 1, TenantID: 10, Role: "editor"}
+	actor := Actor{UserID: 1, TenantID: 10, PrimaryWorkspaceID: 100, Role: "editor"}
 	ctx := WithActor(context.Background(), actor)
 
 	got, ok := ActorFromCtx(ctx)
@@ -28,9 +28,22 @@ func TestMustActorPanics(t *testing.T) {
 }
 
 func TestMustActorReturns(t *testing.T) {
-	actor := Actor{UserID: 5, TenantID: 20, Role: "tenant_admin"}
+	actor := Actor{UserID: 5, TenantID: 20, PrimaryWorkspaceID: 200, Role: "tenant_admin"}
 	ctx := WithActor(context.Background(), actor)
 
 	got := MustActor(ctx)
 	assert.Equal(t, actor, got)
 }
+
+func TestActorCarriesPrimaryWorkspaceID(t *testing.T) {
+	ctx := WithActor(context.Background(), Actor{
+		UserID:             10,
+		TenantID:           20,
+		PrimaryWorkspaceID: 30,
+		Role:               "member",
+	})
+
+	actor, ok := ActorFromCtx(ctx)
+	assert.True(t, ok)
+	assert.Equal(t, int64(30), actor.PrimaryWorkspaceID)
+}