feat: HLS streaming, transcripts, agent course generation & landing-page course previews (#663)

New features:
- HLS video encoding/streaming (hls routes, hls-encoder) and a media
  transcripts pipeline (transcripts route + media-transcript queries)
- AI assistant chat vs. run model: agent-course-generation worker/queue,
  run-monitor pane, chat-changes card, content ask-ai bar
- Per-theme course-page previews across org landing-page themes (bold,
  classic, corporate, editorial, etc.) with a shared course token/component set
- View-as-student mode and login-link / link-invite invite flows

Refactor:
- Extract packages/core consolidating config (env, storage, dashboard-url),
  services and utils previously duplicated under apps/api/src/config
- Remove legacy agent service modules (chat-tools, chat-context,
  context-window, document, fetch-url, lesson-content)
- Relax Cross-Origin-Resource-Policy to allow cross-origin media embedding
- Add format script to tenant-router so turbo run format covers it

packages/core/src/utils/sanitize-html.ts

@@ -0,0 +1,39 @@
+import { createSanitizeHtmlConfig, stripSvgDataUrls } from '@cio/utils/functions';
+import DOMPurify from 'isomorphic-dompurify';
+
+export function sanitizeHtml(html: string): string {
+  let sanitized = DOMPurify.sanitize(html, createSanitizeHtmlConfig());
+
+  sanitized = stripSvgDataUrls(sanitized);
+
+  return sanitized;
+}
+
+export function sanitizeOptionalHtml(html: string | undefined): string | undefined;
+export function sanitizeOptionalHtml(html: string | null | undefined): string | null | undefined;
+export function sanitizeOptionalHtml(html: string | null | undefined): string | null | undefined {
+  if (html == null) return html;
+
+  return sanitizeHtml(html);
+}
+
+export function sanitizeUnknownStrings<T>(value: T): T {
+  if (typeof value === 'string') {
+    return sanitizeHtml(value) as T;
+  }
+
+  if (Array.isArray(value)) {
+    return value.map((item) => sanitizeUnknownStrings(item)) as T;
+  }
+
+  if (value && typeof value === 'object') {
+    const sanitizedEntries = Object.entries(value).map(([key, entryValue]) => [
+      key,
+      sanitizeUnknownStrings(entryValue)
+    ]);
+
+    return Object.fromEntries(sanitizedEntries) as T;
+  }
+
+  return value;
+}