feat(tenant): business-date-scope monitor lease lanes and authorization-failure cancellation

Add an optional lane filter to the monitor task lease so callers can pull
a specific lane (e.g. high) and scope authorization-failure cancellation
to the failing task's business date, so a challenge on one day no longer
cancels queued tasks for another day. Monitor authorization-failure
cancellation now requires a business date and no-ops without one. Also
stop writing the nonexistent desktop_tasks.completed_at column when
canceling queued tasks for an authorization failure.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/internal/tenant/app/monitoring_callback_service_test.go

@@ -647,6 +647,7 @@ func TestMonitorAuthorizationFollowupCancellationIsPlatformScopedAcrossAccounts(
 		TargetClientID:  uuid.New(),
 		TargetAccountID: uuid.New(),
 		Platform:        "doubao",
+		Payload:         []byte(`{"business_date":"2026-07-22"}`),
 	}
 
 	rows, err := loadQueuedDesktopAuthorizationFailureCandidates(context.Background(), tx, task)
@@ -659,6 +660,10 @@ func TestMonitorAuthorizationFollowupCancellationIsPlatformScopedAcrossAccounts(
 	assert.Contains(t, query, "AND target_client_id = $4")
 	assert.Contains(t, query, "AND (kind = 'monitor' OR target_account_id = $5)")
 	assert.Contains(t, query, "AND platform_id = $6")
+	assert.Contains(t, query, "COALESCE( NULLIF(payload ->> 'business_date', '')")
+	assert.Contains(t, query, "= $8")
+	require.Len(t, tx.queryArgs, 8)
+	assert.Equal(t, "2026-07-22", tx.queryArgs[7])
 	assert.Equal(t, "aborted", desktopAuthorizationFollowupTaskStatus("monitor"))
 	assert.Equal(t, "failed", desktopAuthorizationFollowupTaskStatus("publish"))
 	assert.Equal(t, "task_canceled", desktopAuthorizationFollowupEventType(&repository.DesktopTask{
@@ -667,6 +672,24 @@ func TestMonitorAuthorizationFollowupCancellationIsPlatformScopedAcrossAccounts(
 	}))
 }
 
+func TestMonitorAuthorizationFollowupCancellationRequiresBusinessDate(t *testing.T) {
+	tx := &captureDailyMonitorTaskTx{}
+	task := &repository.DesktopTask{
+		Kind:            "monitor",
+		TenantID:        77,
+		WorkspaceID:     88,
+		TargetClientID:  uuid.New(),
+		TargetAccountID: uuid.New(),
+		Platform:        "doubao",
+	}
+
+	rows, err := loadQueuedDesktopAuthorizationFailureCandidates(context.Background(), tx, task)
+
+	require.NoError(t, err)
+	assert.Empty(t, rows)
+	assert.False(t, tx.queryCalled)
+}
+
 func TestFailRemainingMonitoringTasksAfterFinalAccountChallengeScopesToModelAndClient(t *testing.T) {
 	targetClientID := uuid.New().String()
 	completedAt := time.Date(2026, 7, 14, 9, 30, 0, 0, time.UTC)