feat(embeds): add embed.classroomio.com public widget host

Serve widgets from short public URLs via tenant-router with R2-backed
assets and runtime API_URL injection, so copy-paste snippets hide infra
paths. Update widget payloads, CSP, upload purge URLs, and dev-only API
inject; document format/stage workflow in AGENTS.md and fix ui-prefix-check
YAML syntax.

apps/tenant-router/wrangler.toml

@@ -9,7 +9,8 @@ compatibility_date = "2026-05-01"
 routes = [
   { pattern = "*.myclassroomio.com/*", zone_name = "myclassroomio.com" },
   { pattern = "myclassroomio.com/*", zone_name = "myclassroomio.com" },
-  { pattern = "app.classroomio.com/*", zone_name = "classroomio.com" }
+  { pattern = "app.classroomio.com/*", zone_name = "classroomio.com" },
+  { pattern = "embed.classroomio.com/*", zone_name = "classroomio.com" }
 ]
 
 # Override per environment. Both values are the `.onrender.com` hostnames
@@ -20,6 +21,8 @@ routes = [
 DASHBOARD_UPSTREAM_HOST = "cio-api.onrender.com"
 API_UPSTREAM_HOST = "cio-api-vymh.onrender.com"
 APEX_REDIRECT_TARGET = "https://classroomio.com"
+EMBED_HOST = "embed.classroomio.com"
+API_URL = "https://api.classroomio.com"
 
 # R2 bucket binding so /hls/* can stream segments directly from Cloudflare,
 # bypassing Render. The bucket name matches the storage config in
@@ -28,6 +31,11 @@ APEX_REDIRECT_TARGET = "https://classroomio.com"
 binding = "VIDEOS_BUCKET"
 bucket_name = "videos"
 
+# Public embed scripts (course-widget, question-type-picker) uploaded by apps/embeds.
+[[r2_buckets]]
+binding = "ASSETS_BUCKET"
+bucket_name = "assets"
+
 # HLS_SIGNING_SECRET is set via `wrangler secret put HLS_SIGNING_SECRET` —
 # never commit it. The same value must be set as HLS_SIGNING_SECRET on the
 # API (Render env) so the cookie minted by the API verifies on the Worker.