feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

server/internal/tenant/repository/queries/desktop_client.sql

@@ -0,0 +1,70 @@
+-- name: RegisterDesktopClient :one
+INSERT INTO desktop_clients (
+    id,
+    tenant_id,
+    workspace_id,
+    user_id,
+    token_hash,
+    device_name,
+    os,
+    cpu_arch,
+    client_version,
+    channel
+)
+VALUES (
+    sqlc.arg(id),
+    sqlc.arg(tenant_id),
+    sqlc.arg(workspace_id),
+    sqlc.arg(user_id),
+    sqlc.arg(token_hash),
+    sqlc.narg(device_name),
+    sqlc.narg(os),
+    sqlc.narg(cpu_arch),
+    sqlc.narg(client_version),
+    sqlc.narg(channel)
+)
+RETURNING *;
+
+-- name: GetDesktopClientByTokenHash :one
+SELECT *
+FROM desktop_clients
+WHERE token_hash = sqlc.arg(token_hash)
+  AND revoked_at IS NULL
+LIMIT 1;
+
+-- name: RotateDesktopClientToken :one
+UPDATE desktop_clients
+SET token_hash = sqlc.arg(token_hash),
+    last_rotated_at = now()
+WHERE id = sqlc.arg(id)
+  AND workspace_id = sqlc.arg(workspace_id)
+  AND revoked_at IS NULL
+RETURNING *;
+
+-- name: HeartbeatDesktopClient :one
+UPDATE desktop_clients
+SET device_name = COALESCE(sqlc.narg(device_name), device_name),
+    os = COALESCE(sqlc.narg(os), os),
+    cpu_arch = COALESCE(sqlc.narg(cpu_arch), cpu_arch),
+    client_version = COALESCE(sqlc.narg(client_version), client_version),
+    channel = COALESCE(sqlc.narg(channel), channel),
+    last_seen_at = now()
+WHERE id = sqlc.arg(id)
+  AND workspace_id = sqlc.arg(workspace_id)
+  AND revoked_at IS NULL
+RETURNING *;
+
+-- name: RevokeDesktopClient :one
+UPDATE desktop_clients
+SET revoked_at = now()
+WHERE id = sqlc.arg(id)
+  AND workspace_id = sqlc.arg(workspace_id)
+  AND revoked_at IS NULL
+RETURNING *;
+
+-- name: ListDesktopClientsByWorkspace :many
+SELECT *
+FROM desktop_clients
+WHERE workspace_id = sqlc.arg(workspace_id)
+  AND revoked_at IS NULL
+ORDER BY last_seen_at DESC NULLS LAST, created_at DESC;