feat: HLS streaming, transcripts, agent course generation & landing-page course previews (#663)

New features:
- HLS video encoding/streaming (hls routes, hls-encoder) and a media
  transcripts pipeline (transcripts route + media-transcript queries)
- AI assistant chat vs. run model: agent-course-generation worker/queue,
  run-monitor pane, chat-changes card, content ask-ai bar
- Per-theme course-page previews across org landing-page themes (bold,
  classic, corporate, editorial, etc.) with a shared course token/component set
- View-as-student mode and login-link / link-invite invite flows

Refactor:
- Extract packages/core consolidating config (env, storage, dashboard-url),
  services and utils previously duplicated under apps/api/src/config
- Remove legacy agent service modules (chat-tools, chat-context,
  context-window, document, fetch-url, lesson-content)
- Relax Cross-Origin-Resource-Policy to allow cross-origin media embedding
- Add format script to tenant-router so turbo run format covers it

packages/db/src/scripts/generate-login-link.ts

@@ -3,8 +3,8 @@ import 'dotenv/config';
 import * as schema from '../schema';
 
 import { eq } from 'drizzle-orm';
-import { SignJWT } from 'jose';
 import { db } from '../drizzle';
+import { mintLoginLinkToken } from '../auth/login-link';
 
 const LOGIN_LINK_TTL_MINUTES = 10;
 
@@ -12,16 +12,6 @@ function getBaseUrl(): string {
   return process.env.PUBLIC_SERVER_URL?.trim() || 'http://localhost:3002';
 }
 
-function getSecret(): Uint8Array {
-  const secret = process.env.BETTER_AUTH_SECRET?.trim();
-
-  if (!secret) {
-    throw new Error('BETTER_AUTH_SECRET is required');
-  }
-
-  return new TextEncoder().encode(secret);
-}
-
 function getArgs() {
   const email = process.argv[2]?.trim().toLowerCase();
   const redirect = process.argv[3]?.trim() || '/';
@@ -42,15 +32,11 @@ async function main() {
     throw new Error(`User not found for email: ${email}`);
   }
 
-  const token = await new SignJWT({
+  const token = await mintLoginLinkToken({
+    userId: user.id,
     email,
-    type: 'login-link'
-  })
-    .setProtectedHeader({ alg: 'HS256' })
-    .setSubject(user.id)
-    .setIssuedAt()
-    .setExpirationTime(`${LOGIN_LINK_TTL_MINUTES}m`)
-    .sign(getSecret());
+    ttlMinutes: LOGIN_LINK_TTL_MINUTES
+  });
 
   const url = new URL('/api/auth/login-link', getBaseUrl());
   url.searchParams.set('token', token);