🐞 FERMION-provider live sessions can be silently unjoinable (no joinUrl, provisioning failure swallowed)

Context

Live session creation picks provider per session: useFermion = isFermionConfigured() && !parsedInput.joinUrl (src/actions/live.ts:32). When it goes the FERMION route, provisioning runs best-effort with .catch(() => undefined) (:51) — on failure the LiveSession is left provider: FERMION with neither providerSessionRef nor a joinUrl.

Learners' Join button renders only when joinUrl exists (learn/page.tsx:321-329) and the Fermion embed path (getLiveSessionEmbedData, live.ts:33-48) is never rendered anywhere — so these sessions are silently unjoinable for everyone.

Proposed implementation

1. Make provisioning failure loud + recoverable: catch → Sentry warning w/ sessionId; keep provider FERMION but expose an admin/creator "fix session" action to retry provisioning or paste an external joinUrl (flipping provider EXTERNAL_LINK).
2. Learner UX fallback: if FERMION session lacks providerSessionRef at read time, show explicit "session setup in progress — we'll email you" state instead of hiding the row.
3. Ship the embed path or remove dead code: render getLiveSessionEmbedData for configured FERMION sessions (SSO login link via ensureFermionUser/getFermionLoginLink) OR delete the dead exports until Phase-B of #52 lands.
4. Add regression test: provisioning rejection → session still created, flagged, creator notified.

Acceptance

• No live session can exist in a state where learners have no way to join or a visible explanation
• Failures alert in Sentry with actionable context

Related: #52. Part of epic #42 / #40 QA.

Start with src/actions/live.ts, especially the Fermion provisioning catch and getLiveSessionEmbedData, then inspect the learner Join-button logic in learn/page.tsx:321-329. Add the regression test described for provisioning rejection and verify that affected sessions show a learner-facing explanation, provide a recovery path, and emit actionable Sentry context.