feat: HLS streaming, transcripts, agent course generation & landing-page course previews (#663)

New features:
- HLS video encoding/streaming (hls routes, hls-encoder) and a media
  transcripts pipeline (transcripts route + media-transcript queries)
- AI assistant chat vs. run model: agent-course-generation worker/queue,
  run-monitor pane, chat-changes card, content ask-ai bar
- Per-theme course-page previews across org landing-page themes (bold,
  classic, corporate, editorial, etc.) with a shared course token/component set
- View-as-student mode and login-link / link-invite invite flows

Refactor:
- Extract packages/core consolidating config (env, storage, dashboard-url),
  services and utils previously duplicated under apps/api/src/config
- Remove legacy agent service modules (chat-tools, chat-context,
  context-window, document, fetch-url, lesson-content)
- Relax Cross-Origin-Resource-Policy to allow cross-origin media embedding
- Add format script to tenant-router so turbo run format covers it

apps/api/src/services/jobs/email-jobs.ts

@@ -2,7 +2,7 @@ import { enqueueEmailSend, isRedisConfigured } from '@cio/jobs';
 import { EmailRegistry, type EmailId, type EmailSchemaFor } from '@cio/email';
 import * as z from 'zod';
 
-import { logRedisUnavailableOnce } from '@api/utils/redis/redis';
+import { logRedisUnavailableOnce } from '@cio/core/utils/redis/redis';
 
 type Recipient = string | string[];
 

apps/api/src/services/jobs/media-jobs.ts

@@ -18,7 +18,7 @@ import {
   isRedisConfigured
 } from '@cio/jobs';
 
-import { logRedisUnavailableOnce } from '@api/utils/redis/redis';
+import { logRedisUnavailableOnce } from '@cio/core/utils/redis/redis';
 import type { TMediaJob } from '@db/types';
 
 export interface StartTranscriptionOnlyMediaJobInput {
@@ -41,7 +41,11 @@ export async function startTranscriptionOnlyMediaJob(input: StartTranscriptionOn
     throw new AppError('Asset not found', ErrorCodes.NOT_FOUND, 404);
   }
 
-  if (asset.kind !== 'video' || asset.provider !== 'upload' || !asset.storageKey) {
+  // HLS uploads carry their pre-extracted audio in `hls_audio_key` and leave
+  // `storage_key` null. Raw MP4 uploads keep using `storage_key`.
+  const transcriptionSourceKey = asset.hlsAudioKey ?? asset.storageKey;
+
+  if (asset.kind !== 'video' || asset.provider !== 'upload' || !transcriptionSourceKey) {
     throw new AppError('Asset cannot be transcribed', ErrorCodes.ASSET_NOT_TRANSCRIBABLE, 400);
   }
 
@@ -71,7 +75,7 @@ export async function startTranscriptionOnlyMediaJob(input: StartTranscriptionOn
     const enqueueResult = await enqueueTranscriptionOnly({
       mediaJobId: job.id,
       assetId: input.assetId,
-      storageKey: asset.storageKey,
+      storageKey: transcriptionSourceKey,
       actorContext: {
         userId: input.triggeredByProfileId,
         organizationId: input.organizationId