feat: HLS streaming, transcripts, agent course generation & landing-page course previews (#663)

New features:
- HLS video encoding/streaming (hls routes, hls-encoder) and a media
  transcripts pipeline (transcripts route + media-transcript queries)
- AI assistant chat vs. run model: agent-course-generation worker/queue,
  run-monitor pane, chat-changes card, content ask-ai bar
- Per-theme course-page previews across org landing-page themes (bold,
  classic, corporate, editorial, etc.) with a shared course token/component set
- View-as-student mode and login-link / link-invite invite flows

Refactor:
- Extract packages/core consolidating config (env, storage, dashboard-url),
  services and utils previously duplicated under apps/api/src/config
- Remove legacy agent service modules (chat-tools, chat-context,
  context-window, document, fetch-url, lesson-content)
- Relax Cross-Origin-Resource-Policy to allow cross-origin media embedding
- Add format script to tenant-router so turbo run format covers it

apps/api/src/routes/org-site/public-course.ts

@@ -1,8 +1,13 @@
 import { ZPublicCourseBySlugParam, ZPublicCourseItemParam } from '@cio/utils/validation/course';
-import { getPublicCourseItemService, getPublicCourseTreeService } from '@api/services/course/public-course';
+import {
+  getPublicCourseItemService,
+  getPublicCourseTreeService,
+  issuePublicHlsCookieService
+} from '@api/services/course/public-course';
 
 import { Hono } from '@api/utils/hono';
 import { handleError } from '@api/utils/errors';
+import { setCookie } from 'hono/cookie';
 import { zValidator } from '@hono/zod-validator';
 
 /**
@@ -52,4 +57,30 @@ export const publicCourseRouter = new Hono()
     } catch (error) {
       return handleError(c, error, 'Failed to load public course item');
     }
+  })
+  /**
+   * POST /org-site/course/:courseSlug/item/:itemSlug/hls-cookie
+   * Anonymous-safe. Verifies that the public lesson exposes an HLS asset
+   * and mints the short-lived `cio_hls` cookie the tenant-router Worker
+   * (prod) and API streaming route (local) both validate before serving
+   * segments. Caller is expected to call this once per lesson page load
+   * before attaching hls.js.
+   */
+  .post('/:courseSlug/item/:itemSlug/hls-cookie', zValidator('param', ZPublicCourseItemParam), async (c) => {
+    try {
+      const { courseSlug, itemSlug } = c.req.valid('param');
+      const result = await issuePublicHlsCookieService(courseSlug, itemSlug);
+
+      setCookie(c, result.cookieName, result.token, {
+        path: '/',
+        httpOnly: true,
+        secure: true,
+        sameSite: 'Lax',
+        maxAge: result.maxAgeSeconds
+      });
+
+      return c.json({ success: true as const, data: { expiresAt: result.expiresAt } });
+    } catch (error) {
+      return handleError(c, error, 'Failed to issue HLS cookie');
+    }
   });