feat: HLS streaming, transcripts, agent course generation & landing-page course previews (#663)

New features:
- HLS video encoding/streaming (hls routes, hls-encoder) and a media
  transcripts pipeline (transcripts route + media-transcript queries)
- AI assistant chat vs. run model: agent-course-generation worker/queue,
  run-monitor pane, chat-changes card, content ask-ai bar
- Per-theme course-page previews across org landing-page themes (bold,
  classic, corporate, editorial, etc.) with a shared course token/component set
- View-as-student mode and login-link / link-invite invite flows

Refactor:
- Extract packages/core consolidating config (env, storage, dashboard-url),
  services and utils previously duplicated under apps/api/src/config
- Remove legacy agent service modules (chat-tools, chat-context,
  context-window, document, fetch-url, lesson-content)
- Relax Cross-Origin-Resource-Policy to allow cross-origin media embedding
- Add format script to tenant-router so turbo run format covers it

apps/api/.env.example

@@ -41,6 +41,14 @@ CLOUDFLARE_ACCOUNT_ID=""
 CLOUDFLARE_BUCKET_DOMAIN=""
 CLOUDFLARE_SECRET_ACCESS_KEY=""
 
+# HMAC secret used to sign the `cio_hls` playback cookie. The same value must
+# be set on the tenant-router Worker (`wrangler secret put HLS_SIGNING_SECRET`)
+# so segments served from R2 at the edge verify against this signature.
+# Without it the cookie endpoints return 503 and HLS playback won't start —
+# uploads still work, so leave it unset for upload-only local development.
+# Generate one with: node -e "console.log(require('crypto').randomBytes(48).toString('base64url'))"
+HLS_SIGNING_SECRET=""
+
 # Sentry (server-side error tracking). Leave SENTRY_DSN unset to disable.
 # Skipped automatically in dev (NODE_ENV !== 'production') and self-hosted (PUBLIC_IS_SELFHOSTED=true).
 SENTRY_DSN=""