feat(embeds): add embed.classroomio.com public widget host

Serve widgets from short public URLs via tenant-router with R2-backed
assets and runtime API_URL injection, so copy-paste snippets hide infra
paths. Update widget payloads, CSP, upload purge URLs, and dev-only API
inject; document format/stage workflow in AGENTS.md and fix ui-prefix-check
YAML syntax.

.github/workflows/ui-prefix-check.yml

@@ -44,7 +44,7 @@ jobs:
             echo "ref=origin/main" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Check ui: prefix on changed UI files
+      - name: 'Check ui: prefix on changed UI files'
         env:
           UI_PREFIX_GIT_BASE: ${{ steps.base.outputs.ref }}
         run: pnpm --filter @cio/ui prefix:check:changed