feat(embeds): add embed.classroomio.com public widget host

Serve widgets from short public URLs via tenant-router with R2-backed
assets and runtime API_URL injection, so copy-paste snippets hide infra
paths. Update widget payloads, CSP, upload purge URLs, and dev-only API
inject; document format/stage workflow in AGENTS.md and fix ui-prefix-check
YAML syntax.

apps/dashboard/src/lib/utils/constants/app.ts

@@ -13,6 +13,8 @@ export const blockedSubdomain = [
   'courses',
   'demo',
   'dev',
+  'embed',
+  'embeds',
   'forum',
   'group',
   'groups',

apps/dashboard/src/lib/utils/csp-domains.js

@@ -5,6 +5,7 @@
 const saasDefaults = {
   scriptSrc: [
     'https://assets.cdn.clsrio.com',
+    'https://embed.classroomio.com',
     'https://cdnjs.cloudflare.com',
     'https://*.posthog.com',
     'https://*.senja.io',