feat: HLS streaming, transcripts, agent course generation & landing-page course previews (#663)

New features:
- HLS video encoding/streaming (hls routes, hls-encoder) and a media
  transcripts pipeline (transcripts route + media-transcript queries)
- AI assistant chat vs. run model: agent-course-generation worker/queue,
  run-monitor pane, chat-changes card, content ask-ai bar
- Per-theme course-page previews across org landing-page themes (bold,
  classic, corporate, editorial, etc.) with a shared course token/component set
- View-as-student mode and login-link / link-invite invite flows

Refactor:
- Extract packages/core consolidating config (env, storage, dashboard-url),
  services and utils previously duplicated under apps/api/src/config
- Remove legacy agent service modules (chat-tools, chat-context,
  context-window, document, fetch-url, lesson-content)
- Relax Cross-Origin-Resource-Policy to allow cross-origin media embedding
- Add format script to tenant-router so turbo run format covers it

apps/dashboard/src/lib/utils/services/auth/client.ts

@@ -5,9 +5,9 @@ import { dev } from '$app/environment';
 
 // Browser baseURL depends on deployment shape:
 //
-//   - Self-hosted: dashboard and API are on different subdomains under
-//     one apex. Browser calls go straight to PUBLIC_SERVER_URL; cookies
-//     cross subdomains via AUTH_COOKIE_DOMAIN. No Worker proxy.
+//   - Self-hosted: browser auth calls stay on the dashboard origin at
+//     `/api/auth/*`; hooks.server.ts forwards them to the API over
+//     PRIVATE_SERVER_URL.
 //
 //   - Cloud (multi-tenant): same-origin via the Cloudflare Worker so
 //     auth cookies stay host-only on whichever tenant/BYOD domain the
@@ -23,9 +23,12 @@ function resolveBaseURL() {
   if (typeof window === 'undefined') {
     return env.PUBLIC_SERVER_URL || 'http://localhost:3002';
   }
-  if (env.PUBLIC_IS_SELFHOSTED === 'true' || dev) {
+  if (dev) {
     return env.PUBLIC_SERVER_URL || `${window.location.origin}/api/auth`;
   }
+  if (env.PUBLIC_IS_SELFHOSTED === 'true') {
+    return `${window.location.origin}/api/auth`;
+  }
   return `${window.location.origin}/proxy/api/auth`;
 }