Initial commit: Null DRM Official

Capture, decrypt, and restream toolkit with compiled-in app modules
(RTE, TG4, BBC), on-device MITM proxy, streamd control plane, and www.
BBC module.yaml is published (clear streams); other module values stay local.

apps/cli/main.go

@@ -0,0 +1,76 @@
+// Command drm is the single entry point for the toolchain: phone capture,
+// catalog lookups, the always-on agent, the streamd control plane and the
+// on-device MITM. Every app module under apps/modules is compiled in.
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"drmdecryption/apps/agent/agentcmd"
+	"drmdecryption/apps/capture/capturecmd"
+	"drmdecryption/apps/cli/catalogcmd"
+	"drmdecryption/apps/cli/modulescmd"
+	"drmdecryption/apps/proxy/proxyctlcmd"
+	"drmdecryption/apps/streamd/servecmd"
+
+	// Links every app module into this binary.
+	_ "drmdecryption/modules/all"
+)
+
+func main() {
+	if len(os.Args) < 2 {
+		usage()
+		os.Exit(2)
+	}
+	cmd, args := os.Args[1], os.Args[2:]
+	var err error
+	switch cmd {
+	case "capture":
+		err = capturecmd.Run(args)
+	case "catalog":
+		err = catalogcmd.Run(args)
+	case "modules":
+		err = modulescmd.Run(args)
+	case "agent":
+		err = agentcmd.Run(args)
+	case "serve":
+		err = servecmd.Run(append([]string{"serve"}, args...))
+	case "proxy":
+		err = proxyctlcmd.Run(args)
+	case "help", "-h", "--help":
+		usage()
+		return
+	default:
+		usage()
+		err = fmt.Errorf("unknown command %q", cmd)
+	}
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "[!]", err)
+		os.Exit(1)
+	}
+}
+
+func usage() {
+	fmt.Fprint(os.Stderr, `drm — DRM capture / restream toolchain
+
+Usage:
+  drm modules                       list compiled-in app modules and their channels
+  drm capture  --app NAME [--channel ID] [--auto-play] [--wvd PATH]
+                                    one-shot phone MITM capture
+  drm catalog  --app NAME --channel ID [--keys] [--json] [--list]
+                                    resolve a channel from its public catalog (no phone)
+  drm agent    run|status|devices|enqueue|cancel [--config …]
+                                    always-on credential refresher
+  drm serve    [--bind …] [--data …] [--token …]
+                                    streamd control plane + dashboard
+  drm proxy    build|push|install-ca|start|stop|discover|pull|clear-proxy
+                                    on-device HTTPS MITM
+
+App modules are compiled in; their local values live in
+apps/modules/<name>/module.yaml (gitignored) and can be overridden per run with
+--<app>.<field> flags or <APP>_<FIELD> environment variables.
+
+Run any subcommand with --help for its own flags.
+`)
+}