feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

server/internal/tenant/repository/queries/auth.sql

@@ -9,12 +9,30 @@ FROM users
 WHERE id = sqlc.arg(id) AND deleted_at IS NULL;
 
 -- name: GetTenantMembership :one
-SELECT id, tenant_id, user_id, tenant_role, created_at
-FROM tenant_memberships
-WHERE user_id = sqlc.arg(user_id) AND deleted_at IS NULL
+SELECT tm.id,
+       tm.tenant_id,
+       tm.user_id,
+       tm.tenant_role,
+       tm.created_at,
+       wm.workspace_id AS primary_workspace_id
+FROM tenant_memberships tm
+JOIN workspace_memberships wm
+  ON wm.tenant_id = tm.tenant_id
+ AND wm.user_id = tm.user_id
+ AND wm.is_primary = TRUE
+WHERE tm.user_id = sqlc.arg(user_id) AND tm.deleted_at IS NULL
 LIMIT 1;
 
 -- name: GetTenantMembershipByTenantAndUser :one
-SELECT id, tenant_id, user_id, tenant_role, created_at
-FROM tenant_memberships
-WHERE tenant_id = sqlc.arg(tenant_id) AND user_id = sqlc.arg(user_id) AND deleted_at IS NULL;
+SELECT tm.id,
+       tm.tenant_id,
+       tm.user_id,
+       tm.tenant_role,
+       tm.created_at,
+       wm.workspace_id AS primary_workspace_id
+FROM tenant_memberships tm
+JOIN workspace_memberships wm
+  ON wm.tenant_id = tm.tenant_id
+ AND wm.user_id = tm.user_id
+ AND wm.is_primary = TRUE
+WHERE tm.tenant_id = sqlc.arg(tenant_id) AND tm.user_id = sqlc.arg(user_id) AND tm.deleted_at IS NULL;