feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

server/internal/shared/messaging/rabbitmq/client.go

@@ -98,6 +98,10 @@ func (c *Client) PublishGenerationEvent(ctx context.Context, body []byte) error
 	return c.publishFanout(ctx, c.cfg.GenerationEventExchange, body)
 }
 
+func (c *Client) PublishDesktopTaskEvent(ctx context.Context, body []byte) error {
+	return c.publishFanout(ctx, c.cfg.DesktopTaskEventExchange, body)
+}
+
 func (c *Client) PublishTemplateAssistTask(ctx context.Context, body []byte) error {
 	return c.publish(ctx, c.cfg.TemplateAssistExchange, c.cfg.TemplateAssistRoutingKey, body)
 }
@@ -180,6 +184,10 @@ func (c *Client) ConsumeGenerationEvents(consumerName string) (<-chan amqp.Deliv
 	return c.consumeFanout(consumerName, c.cfg.GenerationEventExchange)
 }
 
+func (c *Client) ConsumeDesktopTaskEvents(consumerName string) (<-chan amqp.Delivery, *amqp.Channel, error) {
+	return c.consumeFanout(consumerName, c.cfg.DesktopTaskEventExchange)
+}
+
 func (c *Client) ConsumeTemplateAssistTask(consumerName string) (<-chan amqp.Delivery, *amqp.Channel, error) {
 	return c.consume(consumerName, c.cfg.TemplateAssistQueue)
 }
@@ -558,6 +566,18 @@ func (c *Client) ensureTopology(conn *amqp.Connection) error {
 		return fmt.Errorf("declare rabbitmq exchange %s: %w", c.cfg.GenerationEventExchange, err)
 	}
 
+	if err := ch.ExchangeDeclare(
+		c.cfg.DesktopTaskEventExchange,
+		"fanout",
+		false,
+		false,
+		false,
+		false,
+		nil,
+	); err != nil {
+		return fmt.Errorf("declare rabbitmq exchange %s: %w", c.cfg.DesktopTaskEventExchange, err)
+	}
+
 	if err := c.ensureWorkQueue(
 		ch,
 		c.cfg.TemplateAssistExchange,