feat(publish): add tenant publish management with desktop deep-link

Expose tenant-authenticated publish task list and retry endpoints so the
admin web can show desktop publish state without an Electron bridge, and
register a `shengxintui://` deep-link so the page can hand off to the
desktop client workbench.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/transport/router.go

@@ -74,6 +74,8 @@ func RegisterRoutes(app *bootstrap.App) {
 	tenantProtected.POST("/accounts/:id/request-delete", desktopAccountHandler.RequestDelete)
 	tenantProtected.POST("/tasks/:id/reconcile", desktopTaskHandler.Reconcile)
 	tenantProtected.POST("/tasks/:id/cancel", desktopTaskHandler.TenantCancel)
+	tenantProtected.GET("/publish-tasks", desktopTaskHandler.TenantListPublish)
+	tenantProtected.POST("/publish-tasks/:id/retry", desktopTaskHandler.TenantRetryPublish)
 	tenantProtected.POST("/publish-jobs", publishJobHandler.Create)
 
 	complianceHandler := NewComplianceHandler(app)