feat: HLS streaming, transcripts, agent course generation & landing-page course previews (#663)

New features:
- HLS video encoding/streaming (hls routes, hls-encoder) and a media
  transcripts pipeline (transcripts route + media-transcript queries)
- AI assistant chat vs. run model: agent-course-generation worker/queue,
  run-monitor pane, chat-changes card, content ask-ai bar
- Per-theme course-page previews across org landing-page themes (bold,
  classic, corporate, editorial, etc.) with a shared course token/component set
- View-as-student mode and login-link / link-invite invite flows

Refactor:
- Extract packages/core consolidating config (env, storage, dashboard-url),
  services and utils previously duplicated under apps/api/src/config
- Remove legacy agent service modules (chat-tools, chat-context,
  context-window, document, fetch-url, lesson-content)
- Relax Cross-Origin-Resource-Policy to allow cross-origin media embedding
- Add format script to tenant-router so turbo run format covers it

apps/api/src/middlewares/api-key.ts

@@ -1,6 +1,6 @@
 import { Context, Next } from 'hono';
 
-import { env } from '@api/config/env';
+import { env } from '@cio/core/config/env';
 
 /**
  * Middleware to authenticate requests using API key

apps/api/src/middlewares/course-member.ts

@@ -2,7 +2,7 @@ import { Context, Next } from 'hono';
 
 import { ErrorCodes } from '@api/utils/errors';
 import { isUserCourseMemberOrOrgAdmin } from '@cio/db/queries/group';
-import { ensureProgramCourseAccess } from '@api/services/course/course';
+import { ensureProgramCourseAccess } from '@cio/core/services/course/course';
 
 /**
  * Middleware to check if the authenticated user is a member of a course's group

apps/api/src/middlewares/license.ts

@@ -1,7 +1,7 @@
 import type { Context, Next } from 'hono';
 
 import type { LicenseFeatureId } from '@cio/utils/license';
-import { env } from '@api/config/env';
+import { env } from '@cio/core/config/env';
 import { isFeatureLicensed } from '@api/services/license';
 
 /**

apps/api/src/middlewares/org-admin-or-api-key.ts

@@ -1,7 +1,7 @@
 import { Context, Next } from 'hono';
 
 import { ErrorCodes } from '@api/utils/errors';
-import { env } from '@api/config/env';
+import { env } from '@cio/core/config/env';
 import { isUserOrgAdmin } from '@cio/db/queries/organization';
 
 export const orgAdminOrApiKeyMiddleware = async (c: Context, next: Next) => {

apps/api/src/middlewares/rate-limiter.ts

@@ -8,8 +8,8 @@ import {
 import type { Context, MiddlewareHandler } from 'hono';
 import { RedisRateLimiter } from '@api/utils/redis/limiter';
 import { userKeyGenerator } from '../utils/redis/key-generators';
-import { env } from '@api/config/env';
-import { logRedisUnavailableOnce, redis } from '@api/utils/redis/redis';
+import { env } from '@cio/core/config/env';
+import { logRedisUnavailableOnce, redis } from '@cio/core/utils/redis/redis';
 
 /** Dashboard SSR and other internal callers authenticate with PRIVATE_SERVER_KEY. */
 export function isTrustedServerApiKeyRequest(c: Context): boolean {

apps/api/src/middlewares/signup-guard.ts

@@ -6,7 +6,7 @@ import {
   hasActiveOrganizationInviteForEmail
 } from '@cio/db/queries/organization';
 
-import { env } from '@api/config/env';
+import { env } from '@cio/core/config/env';
 
 type OrgSettings = {
   signup?: {