feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

server/migrations/20260420100010_add_workspace_to_desktop_tables.up.sql

@@ -0,0 +1,31 @@
+ALTER TABLE tenant_monitoring_quotas
+    ADD COLUMN IF NOT EXISTS workspace_id BIGINT REFERENCES workspaces(id);
+
+UPDATE tenant_monitoring_quotas q
+SET workspace_id = w.id
+FROM workspaces w
+WHERE w.tenant_id = q.tenant_id
+  AND w.is_default = TRUE
+  AND q.workspace_id IS NULL;
+
+ALTER TABLE tenant_monitoring_quotas
+    ALTER COLUMN workspace_id SET NOT NULL;
+
+CREATE INDEX IF NOT EXISTS idx_monitoring_quotas_workspace
+    ON tenant_monitoring_quotas (workspace_id);
+
+ALTER TABLE platform_accounts
+    ADD COLUMN IF NOT EXISTS workspace_id BIGINT REFERENCES workspaces(id);
+
+UPDATE platform_accounts a
+SET workspace_id = w.id
+FROM workspaces w
+WHERE w.tenant_id = a.tenant_id
+  AND w.is_default = TRUE
+  AND a.workspace_id IS NULL;
+
+ALTER TABLE platform_accounts
+    ALTER COLUMN workspace_id SET NOT NULL;
+
+CREATE INDEX IF NOT EXISTS idx_platform_accounts_workspace
+    ON platform_accounts (workspace_id);