feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

server/internal/tenant/transport/desktop_content_handler.go

@@ -0,0 +1,42 @@
+package transport
+
+import (
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/geo-platform/tenant-api/internal/bootstrap"
+	"github.com/geo-platform/tenant-api/internal/shared/response"
+	"github.com/geo-platform/tenant-api/internal/tenant/app"
+)
+
+type DesktopContentHandler struct {
+	svc *app.DesktopContentService
+}
+
+func NewDesktopContentHandler(a *bootstrap.App) *DesktopContentHandler {
+	return &DesktopContentHandler{
+		svc: app.NewDesktopContentService(
+			a.DB,
+			a.AuditLogs,
+			a.ObjectStorage,
+			a.Cache,
+		),
+	}
+}
+
+func (h *DesktopContentHandler) Article(c *gin.Context) {
+	articleID, err := strconv.ParseInt(c.Param("id"), 10, 64)
+	if err != nil || articleID <= 0 {
+		response.Error(c, response.ErrBadRequest(40095, "invalid_article_id", "article id must be a positive integer"))
+		return
+	}
+
+	data, svcErr := h.svc.Article(c.Request.Context(), MustDesktopClient(c.Request.Context()), articleID)
+	if svcErr != nil {
+		response.Error(c, svcErr)
+		return
+	}
+
+	response.Success(c, data)
+}