feat: HLS streaming, transcripts, agent course generation & landing-page course previews (#663)

New features:
- HLS video encoding/streaming (hls routes, hls-encoder) and a media
  transcripts pipeline (transcripts route + media-transcript queries)
- AI assistant chat vs. run model: agent-course-generation worker/queue,
  run-monitor pane, chat-changes card, content ask-ai bar
- Per-theme course-page previews across org landing-page themes (bold,
  classic, corporate, editorial, etc.) with a shared course token/component set
- View-as-student mode and login-link / link-invite invite flows

Refactor:
- Extract packages/core consolidating config (env, storage, dashboard-url),
  services and utils previously duplicated under apps/api/src/config
- Remove legacy agent service modules (chat-tools, chat-context,
  context-window, document, fetch-url, lesson-content)
- Relax Cross-Origin-Resource-Policy to allow cross-origin media embedding
- Add format script to tenant-router so turbo run format covers it

packages/db/src/constants.ts

@@ -1,4 +1,11 @@
-const { TRUSTED_ORIGINS: TRUSTED_ORIGINS_STRING, PUBLIC_SERVER_URL } = process.env;
+const {
+  DASHBOARD_ORIGIN,
+  PUBLIC_IS_SELFHOSTED,
+  PUBLIC_SERVER_URL,
+  TRUSTED_ORIGINS: TRUSTED_ORIGINS_STRING
+} = process.env;
+
+const dashboardOrigin = DASHBOARD_ORIGIN?.trim().replace(/\/$/, '');
 
 const DEFAULT_TRUSTED_ORIGINS = [
   'http://localhost:5173',
@@ -16,13 +23,15 @@ const DEFAULT_TRUSTED_ORIGINS = [
   'https://login.okta.com'
 ];
 
-export const TRUSTED_ORIGINS = TRUSTED_ORIGINS_STRING
-  ? [
-      ...DEFAULT_TRUSTED_ORIGINS,
-      ...TRUSTED_ORIGINS_STRING.split(',')
-        .map((s) => s.trim())
+export const TRUSTED_ORIGINS = [
+  ...DEFAULT_TRUSTED_ORIGINS,
+  ...(TRUSTED_ORIGINS_STRING
+    ? TRUSTED_ORIGINS_STRING.split(',')
+        .map((origin) => origin.trim())
         .filter(Boolean)
-    ]
-  : DEFAULT_TRUSTED_ORIGINS;
+    : []),
+  ...(dashboardOrigin ? [dashboardOrigin] : [])
+];
 
-export const BASE_URL = PUBLIC_SERVER_URL || 'http://localhost:3002';
+export const BASE_URL =
+  PUBLIC_IS_SELFHOSTED === 'true' && dashboardOrigin ? dashboardOrigin : PUBLIC_SERVER_URL || 'http://localhost:3002';