🎓 Complete Fermion integration: DRM video upload wiring + code-lab embed (currently placeholder even when configured)

Context

Fermion (codedamn backend) is isolated in src/lib/fermion/* but three capabilities are dead-ended:

1. DRM video upload never wired: createVideoUpload/markUploadedAndProcess (src/lib/fermion/video.ts:20-56) have zero callers. The studio curriculum form promises "DRM uploads via Fermion appear here once FERMION_API_KEY is set" (curriculum-builder.tsx:380-383) but only external-URL lessons function today.
2. Code labs are a permanent placeholder: CODE_LAB lessons render a static card ("launches embedded once Fermion is configured") unconditionally — even WITH a key. requestDsaRun, getDsaRunResult, recordSandboxSession (labs.ts) plus ensureFermionUser/getFermionLoginLink (users.ts) are dead exports; no iframe/embed/SSO launch path exists. CSP already whitelists .fermion.app/.codedamn.com frames (next.config.ts).
3. Webhook reconciliation gap: fermion webhook marks VideoAsset READY/FAILED but a missed delivery strands assets PROCESSING forever — the referenced "reconciliation job (M13)" does not exist.

Proposed implementation

Phase A (labs): implement learner lab launch — ensure Fermion user → fetch login/embed link → sandboxed iframe per labConfig.labRef; persist SandboxSession rows via recordSandboxSession on completion events; extend webhook handler for lab events.
Phase B (video): studio upload action calling createVideoUpload → direct browser upload to returned URL → markUploadedAndProcess → existing webhook flips READY; show transcode status on VideoAsset admin list.
Phase C (ops): M13 cron to reconcile stuck PROCESSING VideoAssets against Fermion API; alert via Sentry.

Acceptance

• CODE_LAB lesson launches an embedded lab for configured courses
• Creator can upload video → DRM playback works end-to-end
• Stuck transcodes self-heal or alert

Blocks #37 content quality for technical tracks. Related epic #42, issue #39 (Fermion prod config).

Start by reading src/lib/fermion/video.ts, labs.ts, and users.ts, then inspect curriculum-builder.tsx and next.config.ts to trace the existing integration points and placeholder behavior. Review the webhook handling described in the issue before choosing an implementation sequence. Done means configured code labs launch, video uploads reach DRM playback, and stuck transcodes reconcile or alert.