feat: HLS streaming, transcripts, agent course generation & landing-page course previews (#663)

New features:
- HLS video encoding/streaming (hls routes, hls-encoder) and a media
  transcripts pipeline (transcripts route + media-transcript queries)
- AI assistant chat vs. run model: agent-course-generation worker/queue,
  run-monitor pane, chat-changes card, content ask-ai bar
- Per-theme course-page previews across org landing-page themes (bold,
  classic, corporate, editorial, etc.) with a shared course token/component set
- View-as-student mode and login-link / link-invite invite flows

Refactor:
- Extract packages/core consolidating config (env, storage, dashboard-url),
  services and utils previously duplicated under apps/api/src/config
- Remove legacy agent service modules (chat-tools, chat-context,
  context-window, document, fetch-url, lesson-content)
- Relax Cross-Origin-Resource-Policy to allow cross-origin media embedding
- Add format script to tenant-router so turbo run format covers it

apps/tenant-router/README.md

@@ -9,10 +9,10 @@ Cloudflare Worker that fronts every browser-facing ClassroomIO host:
 
 The Worker forwards each request to one of two Render services based on path:
 
-| Path | Upstream |
-|---|---|
-| `/proxy/*` | API service (`/proxy` prefix stripped, rest forwarded as-is) |
-| anything else | Dashboard service |
+| Path          | Upstream                                                     |
+| ------------- | ------------------------------------------------------------ |
+| `/proxy/*`    | API service (`/proxy` prefix stripped, rest forwarded as-is) |
+| anything else | Dashboard service                                            |
 
 The `/proxy` prefix is the same-origin escape hatch the dashboard's
 browser code uses so its auth cookies stay host-only while still reaching
@@ -39,11 +39,11 @@ pnpm --filter @cio/tenant-router tail
 
 ## Env vars (wrangler.toml `[vars]`)
 
-| Var | Value |
-|---|---|
-| `DASHBOARD_UPSTREAM_HOST` | `.onrender.com` host of the dashboard service (no scheme) |
-| `API_UPSTREAM_HOST` | `.onrender.com` host of the API service |
-| `APEX_REDIRECT_TARGET` | URL to redirect `myclassroomio.com` apex to (default `https://classroomio.com`) |
+| Var                       | Value                                                                           |
+| ------------------------- | ------------------------------------------------------------------------------- |
+| `DASHBOARD_UPSTREAM_HOST` | `.onrender.com` host of the dashboard service (no scheme)                       |
+| `API_UPSTREAM_HOST`       | `.onrender.com` host of the API service                                         |
+| `APEX_REDIRECT_TARGET`    | URL to redirect `myclassroomio.com` apex to (default `https://classroomio.com`) |
 
 Update the values in `wrangler.toml` after looking them up in the Render dashboard.