feat(embeds): add embed.classroomio.com public widget host

Serve widgets from short public URLs via tenant-router with R2-backed
assets and runtime API_URL injection, so copy-paste snippets hide infra
paths. Update widget payloads, CSP, upload purge URLs, and dev-only API
inject; document format/stage workflow in AGENTS.md and fix ui-prefix-check
YAML syntax.

apps/website/src/lib/components/question-types.svelte

@@ -16,8 +16,5 @@
 </section>
 
 <svelte:head>
-  <script
-    type="module"
-    src="https://assets.cdn.clsrio.com/embeds/question-type-picker/question-type-picker.js"
-  ></script>
+  <script type="module" src="https://embed.classroomio.com/question-type-picker"></script>
 </svelte:head>