fix(api): use admin app URL for teacher auto-enroll email links (#771)

* fix(api): use admin app URL for teacher auto-enroll links

Teacher payment-request emails now build course and grant-access URLs
with getAppBaseUrl() instead of getDashboardBaseUrl(org), so links
point at app.classroomio.com rather than a custom or tenant domain.

Document the teacher vs student email link rule in AGENTS.md.

Co-authored-by: Rotimi Best <[email protected]>

* docs: surface email link URL rules where emails are wired

Document getAppBaseUrl vs getDashboardBaseUrl in dashboard-url.ts,
packages/email/README.md, enqueueTransactionalEmail JSDoc, and AGENTS.md
so staff vs learner hosts are discoverable when building email links.

Co-authored-by: Rotimi Best <[email protected]>

---------

Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Rotimi Best <[email protected]>

packages/email/README.md

@@ -46,6 +46,29 @@ await send('forgotPassword', {
 });
 ```
 
+## Email link URLs
+
+Email templates receive fully-built URLs in their `fields` — templates do **not** choose the host. Callers in `apps/api` (or other services) must build links before calling `enqueueTransactionalEmail` or `send`.
+
+Import helpers from `@cio/core/config/dashboard-url`:
+
+| Recipient | Helper | Use for |
+| --- | --- | --- |
+| Teacher, tutor, admin | `getAppBaseUrl()` | Course management, grading, team invites, auto-enroll |
+| Student, learner | `getDashboardBaseUrl(org)` | Course enroll, audience invites, login |
+
+```typescript
+import { getAppBaseUrl, getDashboardBaseUrl } from '@cio/core/config/dashboard-url';
+
+// Staff dashboard action (admin app — not org custom domain)
+const autoEnrollUrl = `${getAppBaseUrl()}/courses/${courseId}/people?grantAccess=${encodeURIComponent(email)}`;
+
+// Learner-facing invite (org public site)
+const inviteUrl = `${getDashboardBaseUrl(org)}/invite/${encodeURIComponent(token)}`;
+```
+
+See also `AGENTS.md` § Email link URLs.
+
 ## Creating Email Templates
 
 ### Basic Example