fix(hls): scope cookie name per-asset to prevent multi-video 403s

When a lesson has two or more uploaded videos each calls mintHlsCookie,
but all wrote to the same `cio_hls` cookie name. The last write won,
leaving every other video with a mismatched token and a 403 from the
CF Worker.

Cookie name is now `cio_hls_${assetId}` so each video owns its own
cookie. The tenant-router Worker, the Hono HLS fallback route, and the
transcripts route all read the per-asset name.

apps/api/src/routes/hls/hls.ts

@@ -111,7 +111,7 @@ export const hlsRouter = new Hono()
     let authorized = false;
     let denyReason: 'no_token_or_session' | 'token_invalid' | 'session_no_role' | 'asset_missing' =
       'no_token_or_session';
-    const token = getCookie(c, HLS_COOKIE_NAME);
+    const token = getCookie(c, `${HLS_COOKIE_NAME}_${assetId}`);
     if (token) {
       const verified = await verifyHlsToken(token);
       if (verified?.assetId === assetId) {

apps/api/src/routes/transcripts/transcripts.ts

@@ -70,7 +70,7 @@ export const transcriptsRouter = new Hono()
     if (!asset) return withCors(null, 404);
 
     let authorized = false;
-    const token = getCookie(c, HLS_COOKIE_NAME);
+    const token = getCookie(c, `${HLS_COOKIE_NAME}_${assetId}`);
     if (token) {
       const verified = await verifyHlsToken(token);
       if (verified?.assetId === assetId) authorized = true;