feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

server/internal/shared/auth/middleware.go

@@ -87,9 +87,10 @@ func Middleware(jwtMgr *Manager, sessions *SessionStore) gin.HandlerFunc {
 		}
 
 		actor := Actor{
-			UserID:   claims.UserID,
-			TenantID: claims.TenantID,
-			Role:     claims.Role,
+			UserID:             claims.UserID,
+			TenantID:           claims.TenantID,
+			PrimaryWorkspaceID: claims.PrimaryWorkspaceID,
+			Role:               claims.Role,
 		}
 		c.Request = c.Request.WithContext(WithActor(c.Request.Context(), actor))
 		c.Next()