feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

server/internal/tenant/repository/common.go

@@ -1,8 +1,10 @@
 package repository
 
 import (
+	"encoding/json"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5/pgtype"
 
 	"github.com/geo-platform/tenant-api/internal/tenant/repository/generated"
@@ -86,3 +88,40 @@ func pgTimestamp(value *time.Time) pgtype.Timestamptz {
 	}
 	return pgtype.Timestamptz{Time: *value, Valid: true}
 }
+
+func pgUUID(value uuid.UUID) pgtype.UUID {
+	return pgtype.UUID{Bytes: value, Valid: true}
+}
+
+func uuidFromPG(value pgtype.UUID) uuid.UUID {
+	if !value.Valid {
+		return uuid.Nil
+	}
+	return uuid.UUID(value.Bytes)
+}
+
+func nullableUUID(value pgtype.UUID) *uuid.UUID {
+	if !value.Valid {
+		return nil
+	}
+	parsed := uuid.UUID(value.Bytes)
+	return &parsed
+}
+
+func marshalJSON(value any) ([]byte, error) {
+	if value == nil {
+		return nil, nil
+	}
+	return json.Marshal(value)
+}
+
+func unmarshalStringSlice(data []byte) ([]string, error) {
+	if len(data) == 0 {
+		return nil, nil
+	}
+	var items []string
+	if err := json.Unmarshal(data, &items); err != nil {
+		return nil, err
+	}
+	return items, nil
+}