feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

server/internal/tenant/app/desktop_task_events.go

@@ -0,0 +1,33 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"time"
+
+	"github.com/geo-platform/tenant-api/internal/shared/messaging/rabbitmq"
+)
+
+type DesktopTaskEvent struct {
+	Type           string    `json:"type"`
+	TaskID         string    `json:"task_id"`
+	JobID          string    `json:"job_id"`
+	WorkspaceID    int64     `json:"workspace_id"`
+	TargetClientID string    `json:"target_client_id"`
+	Status         string    `json:"status"`
+	Kind           string    `json:"kind"`
+	UpdatedAt      time.Time `json:"updated_at"`
+}
+
+func publishDesktopTaskEvent(ctx context.Context, client *rabbitmq.Client, event DesktopTaskEvent) error {
+	if client == nil {
+		return nil
+	}
+
+	payload, err := json.Marshal(event)
+	if err != nil {
+		return err
+	}
+
+	return client.PublishDesktopTaskEvent(ctx, payload)
+}