feat: HLS streaming, transcripts, agent course generation & landing-page course previews (#663)

New features:
- HLS video encoding/streaming (hls routes, hls-encoder) and a media
  transcripts pipeline (transcripts route + media-transcript queries)
- AI assistant chat vs. run model: agent-course-generation worker/queue,
  run-monitor pane, chat-changes card, content ask-ai bar
- Per-theme course-page previews across org landing-page themes (bold,
  classic, corporate, editorial, etc.) with a shared course token/component set
- View-as-student mode and login-link / link-invite invite flows

Refactor:
- Extract packages/core consolidating config (env, storage, dashboard-url),
  services and utils previously duplicated under apps/api/src/config
- Remove legacy agent service modules (chat-tools, chat-context,
  context-window, document, fetch-url, lesson-content)
- Relax Cross-Origin-Resource-Policy to allow cross-origin media embedding
- Add format script to tenant-router so turbo run format covers it

.env.example

@@ -12,14 +12,6 @@ POSTGRES_DB=classroomio
 POSTGRES_USER=postgres
 POSTGRES_PASSWORD=postgres
 
-# Public URL where the API is reachable from browsers
-# Local: http://localhost:3081 | Production: https://api.yourdomain.com
-PUBLIC_SERVER_URL=http://localhost:3081
-
-# Comma-separated origins allowed by CORS
-# Local: http://localhost:3082 | Production: https://app.yourdomain.com
-TRUSTED_ORIGINS=http://localhost:3082,http://localhost:5173
-
 # Auth secret for session signing (use a long random string in production)
 BETTER_AUTH_SECRET=replace-with-a-long-random-secret
 
@@ -42,9 +34,21 @@ PRIVATE_SERVER_URL=http://api:3081
 # When set, invite emails and other links point here instead of app.classroomio.com
 DASHBOARD_ORIGIN=http://localhost:3082
 
+# Optional direct API origin. Dashboard browser calls are proxied through
+# DASHBOARD_ORIGIN, so normal self-hosted auth does not need this to share a
+# cookie domain with the dashboard.
+# Local: http://localhost:3081 | Production fallback: https://api.yourdomain.com
+PUBLIC_SERVER_URL=http://localhost:3081
+
+# Optional comma-separated origins allowed when browsers call the API directly.
+# Normal self-hosted dashboard auth/API traffic is same-origin through the dashboard proxy.
+# DASHBOARD_ORIGIN is trusted automatically.
+TRUSTED_ORIGINS=
+
 # CSP: external domains allowed by Content-Security-Policy.
 # These are runtime env vars — set them when running the container (no rebuild needed).
-# Comma-separated. Include your CDN, API, video, and font domains.
+# Comma-separated. Include your CDN, video, and font domains. You do not need
+# to add the API here for normal dashboard traffic because API calls are proxied same-origin.
 # ALLOWED_EXTERNAL_DOMAINS overrides all per-directive vars below.
 ALLOWED_EXTERNAL_DOMAINS=
 # Per-directive overrides (optional, comma-separated):
@@ -96,10 +100,6 @@ GOOGLE_CLIENT_SECRET=
 # PUBLIC_GOOGLE_PICKER_CLIENT_ID=
 # PUBLIC_GOOGLE_PICKER_API_KEY=
 
-# Cookie domain for auth. Set to your root domain (e.g. .yourdomain.com) when API and dashboard use different subdomains.
-# Without this, auth cookies may not be set and login will fail.
-AUTH_COOKIE_DOMAIN=
-
 # Dashboard domain routing
 PRIVATE_APP_HOST=localhost
 PRIVATE_APP_SUBDOMAINS=app