fix(hls): scope cookie name per-asset to prevent multi-video 403s

When a lesson has two or more uploaded videos each calls mintHlsCookie,
but all wrote to the same `cio_hls` cookie name. The last write won,
leaving every other video with a mismatched token and a 403 from the
CF Worker.

Cookie name is now `cio_hls_${assetId}` so each video owns its own
cookie. The tenant-router Worker, the Hono HLS fallback route, and the
transcripts route all read the per-asset name.

packages/core/src/services/assets/assets.ts

@@ -714,7 +714,7 @@ export async function mintHlsToken(assetId: string): Promise<{
   return {
     token: `${payload}.${signature}`,
     expiresAt: new Date(exp * 1000).toISOString(),
-    cookieName: HLS_COOKIE_NAME,
+    cookieName: `${HLS_COOKIE_NAME}_${assetId}`,
     maxAgeSeconds: HLS_COOKIE_TTL_SECONDS
   };
 }