feat(desktop): implement workspace foundation + desktop-client skeleton

Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.

server/migrations/20260421100000_create_desktop_clients.up.sql

@@ -0,0 +1,24 @@
+CREATE TABLE desktop_clients (
+    id UUID PRIMARY KEY,
+    tenant_id BIGINT NOT NULL REFERENCES tenants(id),
+    workspace_id BIGINT NOT NULL REFERENCES workspaces(id),
+    user_id BIGINT NOT NULL REFERENCES users(id),
+    token_hash BYTEA NOT NULL UNIQUE,
+    device_name TEXT,
+    os TEXT,
+    cpu_arch TEXT,
+    client_version TEXT,
+    channel TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    last_seen_at TIMESTAMPTZ,
+    last_rotated_at TIMESTAMPTZ,
+    revoked_at TIMESTAMPTZ
+);
+
+CREATE INDEX idx_desktop_clients_workspace
+    ON desktop_clients (workspace_id)
+    WHERE revoked_at IS NULL;
+
+CREATE INDEX idx_desktop_clients_user
+    ON desktop_clients (user_id)
+    WHERE revoked_at IS NULL;