feat(monitoring): generate daily tasks and optimize heartbeat writes

Adds a MonitoringDailyTaskWorker that materializes and dispatches
daily collect tasks from active subscription/desktop-client state,
with per-run atomic metrics and a Prometheus collector. Dashboard
and question-detail APIs now surface a platform_authorization_status
so the UI can distinguish no-desktop-client, no-authorized-platforms,
and authorized states; quota/access-state lookups resolve by request
workspace instead of tenant.

Hardens heartbeat: a desktop_client_primary_leases table gives
per-(tenant, workspace) sticky primary selection, read-mostly lease
resolution avoids a per-heartbeat transaction, and unchanged platform
access reports skip snapshot upserts outside a 10-minute refresh
window. Adds heartbeat primary/snapshot metrics exposed via
token-protected tenant-api /api/internal/metrics endpoints plus
Prometheus. Monitoring quota seed is removed from dev-seed since
daily plans now derive from desktop bindings, and the projection
uses the canonical six-platform catalog so platforms with zero
samples still render.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/app/monitoring_service_date_test.go

@@ -4,6 +4,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -81,7 +82,7 @@ func TestFilterMonitoringPlatformsReturnsSelectedPlatform(t *testing.T) {
 	}, filtered)
 }
 
-func TestFilterMonitoringPlatformsFallsBackToDisplayName(t *testing.T) {
+func TestFilterMonitoringPlatformsDropsUnauthorizedSelection(t *testing.T) {
 	platforms := []monitoringPlatformMetadata{
 		{ID: "deepseek", Name: "DeepSeek"},
 	}
@@ -89,9 +90,7 @@ func TestFilterMonitoringPlatformsFallsBackToDisplayName(t *testing.T) {
 
 	filtered := filterMonitoringPlatforms(platforms, &selected)
 
-	assert.Equal(t, []monitoringPlatformMetadata{
-		{ID: "doubao", Name: "豆包"},
-	}, filtered)
+	assert.Empty(t, filtered)
 }
 
 func TestNormalizeMonitoringPlatformIDCanonicalizesLatestIDs(t *testing.T) {
@@ -127,8 +126,40 @@ func TestIntersectMonitoringPlatformsAcceptsCanonicalIDs(t *testing.T) {
 	}, filtered)
 }
 
-func TestReconcileEnabledMonitoringPlatformsBackfillsSupportedCatalog(t *testing.T) {
-	assert.Equal(t, []string{"yuanbao", "kimi", "wenxin", "deepseek", "doubao", "qwen"}, reconcileEnabledMonitoringPlatforms([]string{"deepseek", "qwen", "doubao"}))
+func TestReconcileEnabledMonitoringPlatformsKeepsAuthorizedSubset(t *testing.T) {
+	assert.Equal(t, []string{"deepseek", "doubao", "qwen"}, reconcileEnabledMonitoringPlatforms([]string{"deepseek", "qwen", "doubao"}))
+	assert.Empty(t, reconcileEnabledMonitoringPlatforms(nil))
+	assert.Empty(t, resolveMonitoringPlatforms(nil))
+}
+
+func TestMonitoringPlatformAuthorizationStatus(t *testing.T) {
+	clientID := uuid.New()
+
+	assert.Equal(t, monitoringPlatformAuthorizationNoDesktopClient, monitoringPlatformAuthorizationStatus(monitoringQuotaConfig{}))
+	assert.Equal(t, monitoringPlatformAuthorizationNoAuthorizedPlatforms, monitoringPlatformAuthorizationStatus(monitoringQuotaConfig{
+		PrimaryClientID: &clientID,
+	}))
+	assert.Equal(t, monitoringPlatformAuthorizationAuthorized, monitoringPlatformAuthorizationStatus(monitoringQuotaConfig{
+		PrimaryClientID:  &clientID,
+		EnabledPlatforms: []string{"qwen"},
+	}))
+}
+
+func TestDefaultMonitoringPlatformMetadataReturnsFullCatalogCopy(t *testing.T) {
+	platforms := defaultMonitoringPlatformMetadata()
+
+	require.Len(t, platforms, 6)
+	assert.Equal(t, []string{"yuanbao", "kimi", "wenxin", "deepseek", "doubao", "qwen"}, monitoringPlatformIDs(platforms))
+
+	platforms[0].ID = "mutated"
+	assert.Equal(t, "yuanbao", defaultMonitoringPlatformMetadata()[0].ID)
+}
+
+func TestLoadMonitoringProjectionPlatformsReturnsFullCatalog(t *testing.T) {
+	platforms, err := loadMonitoringProjectionPlatforms(nil, nil, 0, 0, time.Time{})
+	require.NoError(t, err)
+
+	assert.Equal(t, []string{"yuanbao", "kimi", "wenxin", "deepseek", "doubao", "qwen"}, monitoringPlatformIDs(platforms))
 }
 
 func TestApplyDerivedRatesToOverviewSnapshotUsesAllSamplesForMentionRate(t *testing.T) {