feat(media): delete videos from the media library

Add an admin flow to permanently delete a media asset and clean up
everything it leaves behind.

- Delete dialog with a destructive, irreversible confirmation; deletion
  is blocked while the video is still attached and shows the in-use
  lessons so the admin can detach first.
- Usage list resolves lesson/course context for each attachment, links
  to the lesson editor via an anchor (right-click "open in new tab"),
  and exposes a refresh button to re-check usage after detaching
  elsewhere.
- Storage cleanup runs as a background maintenance job: the producer
  captures the asset's object keys/prefixes up front and an idempotent
  worker sweeps HLS segments, thumbnails, audio, transcript, and the
  raw upload from object storage.

Also harden usage accounting so stale attachments cannot trap an asset:

- asset_usages has no FK to its polymorphic target, so prune a lesson's
  usage rows whenever the lesson is hard-deleted (single + bulk paths).
- Usage resolution drops orphaned lesson usages (lesson gone or course
  soft-deleted) so they neither appear in the list nor block deletion.

Document the icon-only button convention (variant="secondary") in
AGENTS.md.

packages/core/src/services/lesson/lesson.ts

@@ -23,6 +23,8 @@ import {
 } from '@cio/db/queries/lesson';
 import type { TUpdateLessonWatchProgress } from '@cio/utils/validation/lesson';
 import { touchCourseUpdatedAt } from '@cio/db/queries/course';
+import { deleteAssetUsagesByTarget } from '@cio/db/queries/assets';
+import { db } from '@cio/db/drizzle';
 import { enrichLessonWithPresignedUrls } from '../../utils/lesson-media';
 import { resolveWatchEnforcedAssetIds } from '../../utils/lesson-watch-enforcement';
 import { resolveItemSlug } from '../course/slug';
@@ -151,7 +153,20 @@ export async function updateLessonService(lessonId: string, data: TLessonUpdate)
  */
 export async function deleteLessonService(lessonId: string): Promise<TLesson> {
   try {
-    const deleted = await deleteLesson(lessonId);
+    const deleted = await db.transaction(async (tx) => {
+      const lesson = await deleteLesson(lessonId, tx);
+      if (!lesson) {
+        return null;
+      }
+
+      // asset_usages.target_id has no FK to lesson, so the lesson delete does
+      // not cascade here. Prune its usage rows in the same transaction to avoid
+      // orphaned attachments that would otherwise block deleting those assets.
+      await deleteAssetUsagesByTarget('lesson', lessonId, tx);
+
+      return lesson;
+    });
+
     if (!deleted) {
       throw new AppError('Failed to delete lesson', ErrorCodes.INTERNAL_ERROR, 500);
     }