feat: add internal review API, transcripts, and NLE marker sync

[diste12]

Ship machine auth, persisted timecode, a media worker, interactive transcripts, and EDL/FCPXML export so this fork can replace Frame.io for in-house review.

Summary

Why

Scope

What areas are affected?

• API routes
• Auth / access control
• Database schema / migration
• UI / UX
• Documentation
• Other

Before opening PR

• I have read CONTRIBUTING.md and followed repository conventions.
• I ran bun run check.
• I ran bun run db:generate if prisma/schema.prisma changed.
• I manually tested affected flows.
• PR title follows Conventional Commits (type(scope): summary).
• I used successResponse / apiErrors for API response changes.
• I used auth() and shared access checks (checkProjectAccess / checkWorkspaceAccess) where relevant.
• I updated docs when behavior changed.
• No secrets or unrelated file changes are included.

Validation notes:

Paste command output or manual test notes here.

Breaking changes

• No breaking changes
• This PR introduces a breaking change (describe below)

Database / migration notes

Screenshots / examples (if relevant)