feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

server/internal/shared/middleware/logger_test.go

@@ -36,7 +36,7 @@ func TestLoggerIncludesDetailedAuthFailureContext(t *testing.T) {
 	mgr := sharedauth.NewManager("logger-test-secret", -1*time.Minute, 7*24*time.Hour)
 	sessions := sharedauth.NewSessionStore(rdb)
 
-	pair, err := mgr.Issue(7, 42, "editor")
+	pair, err := mgr.Issue(7, 42, 420, "editor")
 	require.NoError(t, err)
 
 	router := gin.New()