feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

server/internal/tenant/repository/auth_repo.go

@@ -20,11 +20,12 @@ type UserRecord struct {
 }
 
 type MembershipRecord struct {
-	ID         int64
-	TenantID   int64
-	UserID     int64
-	TenantRole string
-	CreatedAt  time.Time
+	ID                 int64
+	TenantID           int64
+	UserID             int64
+	PrimaryWorkspaceID int64
+	TenantRole         string
+	CreatedAt          time.Time
 }
 
 type AuthRepository interface {
@@ -87,11 +88,12 @@ func (r *authRepository) GetTenantMembership(ctx context.Context, userID int64)
 	}
 
 	return &MembershipRecord{
-		ID:         row.ID,
-		TenantID:   row.TenantID,
-		UserID:     row.UserID,
-		TenantRole: row.TenantRole,
-		CreatedAt:  timeFromTimestamp(row.CreatedAt),
+		ID:                 row.ID,
+		TenantID:           row.TenantID,
+		UserID:             row.UserID,
+		PrimaryWorkspaceID: row.PrimaryWorkspaceID,
+		TenantRole:         row.TenantRole,
+		CreatedAt:          timeFromTimestamp(row.CreatedAt),
 	}, nil
 }
 
@@ -105,10 +107,11 @@ func (r *authRepository) GetTenantMembershipByTenantAndUser(ctx context.Context,
 	}
 
 	return &MembershipRecord{
-		ID:         row.ID,
-		TenantID:   row.TenantID,
-		UserID:     row.UserID,
-		TenantRole: row.TenantRole,
-		CreatedAt:  timeFromTimestamp(row.CreatedAt),
+		ID:                 row.ID,
+		TenantID:           row.TenantID,
+		UserID:             row.UserID,
+		PrimaryWorkspaceID: row.PrimaryWorkspaceID,
+		TenantRole:         row.TenantRole,
+		CreatedAt:          timeFromTimestamp(row.CreatedAt),
 	}, nil
 }