feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

server/internal/shared/config/config.go

@@ -77,6 +77,7 @@ type RabbitMQConfig struct {
 	GenerationDLQ                string `mapstructure:"generation_dlq"`
 	GenerationDLQRouteKey        string `mapstructure:"generation_dlq_routing_key"`
 	GenerationEventExchange      string `mapstructure:"generation_event_exchange"`
+	DesktopTaskEventExchange     string `mapstructure:"desktop_task_event_exchange"`
 	TemplateAssistExchange       string `mapstructure:"template_assist_exchange"`
 	TemplateAssistRoutingKey     string `mapstructure:"template_assist_routing_key"`
 	TemplateAssistQueue          string `mapstructure:"template_assist_queue"`
@@ -471,6 +472,9 @@ func normalizeRabbitMQConfig(cfg *RabbitMQConfig) {
 	if strings.TrimSpace(cfg.GenerationEventExchange) == "" {
 		cfg.GenerationEventExchange = "generation.event"
 	}
+	if strings.TrimSpace(cfg.DesktopTaskEventExchange) == "" {
+		cfg.DesktopTaskEventExchange = "desktop.task.event"
+	}
 	if strings.TrimSpace(cfg.TemplateAssistExchange) == "" {
 		cfg.TemplateAssistExchange = "template.assist"
 	}