feat(embeds): add embed.classroomio.com public widget host

Serve widgets from short public URLs via tenant-router with R2-backed
assets and runtime API_URL injection, so copy-paste snippets hide infra
paths. Update widget payloads, CSP, upload purge URLs, and dev-only API
inject; document format/stage workflow in AGENTS.md and fix ui-prefix-check
YAML syntax.

pnpm-lock.yaml

@@ -782,6 +782,10 @@ importers:
         version: 4.2.1
 
   apps/tenant-router:
+    dependencies:
+      '@cio/utils':
+        specifier: workspace:*
+        version: link:../../packages/utils
     devDependencies:
       '@cloudflare/workers-types':
         specifier: ^4.20250109.0