feat: HLS streaming, transcripts, agent course generation & landing-page course previews (#663)

New features:
- HLS video encoding/streaming (hls routes, hls-encoder) and a media
  transcripts pipeline (transcripts route + media-transcript queries)
- AI assistant chat vs. run model: agent-course-generation worker/queue,
  run-monitor pane, chat-changes card, content ask-ai bar
- Per-theme course-page previews across org landing-page themes (bold,
  classic, corporate, editorial, etc.) with a shared course token/component set
- View-as-student mode and login-link / link-invite invite flows

Refactor:
- Extract packages/core consolidating config (env, storage, dashboard-url),
  services and utils previously duplicated under apps/api/src/config
- Remove legacy agent service modules (chat-tools, chat-context,
  context-window, document, fetch-url, lesson-content)
- Relax Cross-Origin-Resource-Policy to allow cross-origin media embedding
- Add format script to tenant-router so turbo run format covers it

apps/tenant-router/wrangler.toml

@@ -1,6 +1,8 @@
 name = "cio-tenant-router"
 main = "src/index.ts"
 compatibility_date = "2026-05-01"
+# Required for the `pg` (node-postgres) driver used to query Hyperdrive.
+compatibility_flags = ["nodejs_compat"]
 
 # Production routes — bind the Worker to every browser-facing host.
 # Tenant subdomains and the apex live on the `myclassroomio.com` zone.
@@ -21,5 +23,27 @@ DASHBOARD_UPSTREAM_HOST = "cio-api.onrender.com"
 API_UPSTREAM_HOST = "cio-api-vymh.onrender.com"
 APEX_REDIRECT_TARGET = "https://classroomio.com"
 
+# R2 bucket binding so /hls/* can stream segments directly from Cloudflare,
+# bypassing Render. The bucket name matches the storage config in
+# packages/agent-runtime/src/config/storage.ts (BUCKET_DEFAULTS.VIDEOS).
+[[r2_buckets]]
+binding = "VIDEOS_BUCKET"
+bucket_name = "videos"
+
+# HLS_SIGNING_SECRET is set via `wrangler secret put HLS_SIGNING_SECRET` —
+# never commit it. The same value must be set as HLS_SIGNING_SECRET on the
+# API (Render env) so the cookie minted by the API verifies on the Worker.
+
+# Org lookup cache. Create with:
+#   wrangler kv namespace create ORG_CACHE
+# then paste the returned id below.
+[[kv_namespaces]]
+binding = "ORG_CACHE"
+id = "d07dc73ade284d41af53b387623df29b"
+
+[[hyperdrive]]
+binding = "HYPERDRIVE"
+id = "9ecbfa45699e452889e72acc64af455b"
+
 [observability]
 enabled = true