feat(publish): add tenant publish management with desktop deep-link

Expose tenant-authenticated publish task list and retry endpoints so the
admin web can show desktop publish state without an Electron bridge, and
register a `shengxintui://` deep-link so the page can hand off to the
desktop client workbench.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/transport/router_test.go

@@ -30,6 +30,8 @@ func TestProtectedRoutes_RequireAuth(t *testing.T) {
 		{http.MethodPost, "/api/tenant/accounts/:id/request-delete"},
 		{http.MethodPost, "/api/tenant/tasks/:id/reconcile"},
 		{http.MethodPost, "/api/tenant/tasks/:id/cancel"},
+		{http.MethodGet, "/api/tenant/publish-tasks"},
+		{http.MethodPost, "/api/tenant/publish-tasks/:id/retry"},
 		{http.MethodPost, "/api/tenant/publish-jobs"},
 		{http.MethodGet, "/api/tenant/media/platforms"},
 		{http.MethodGet, "/api/tenant/workspace/overview"},
@@ -77,10 +79,12 @@ func TestDesktopClientRoutes_ClientTokenAuth(t *testing.T) {
 	}{
 		{http.MethodGet, "/api/desktop/dispatch"},
 		{http.MethodGet, "/api/desktop/accounts"},
+		{http.MethodGet, "/api/desktop/publish-tasks"},
 		{http.MethodGet, "/api/desktop/content/assets/:token"},
 		{http.MethodPost, "/api/desktop/clients/offline"},
 		{http.MethodPost, "/api/desktop/tasks/lease"},
 		{http.MethodPost, "/api/desktop/tasks/:id/result"},
+		{http.MethodPost, "/api/desktop/publish-tasks/:id/retry"},
 		{http.MethodPost, "/api/desktop/monitoring/tasks/lease"},
 		{http.MethodPost, "/api/desktop/monitoring/tasks/resume"},
 		{http.MethodPost, "/api/desktop/monitoring/tasks/:id/result"},