Initial commit: Null DRM Official

Capture, decrypt, and restream toolkit with compiled-in app modules
(RTE, TG4, BBC), on-device MITM proxy, streamd control plane, and www.
BBC module.yaml is published (clear streams); other module values stay local.

apps/pkg/README.md

@@ -0,0 +1,37 @@
+# pkg — shared Go libraries
+
+Imported by `apps/capture`, `apps/agent`, `apps/streamd`, `apps/proxy`, `apps/cli`
+and `apps/modules` as module `drmdecryption` via:
+
+```go
+replace drmdecryption => ../pkg
+```
+
+## Packages
+
+| Package | Role |
+|---------|------|
+| `adb` | ADB client (shell, push/pull, UI dump, tap) |
+| `app` | App plugin interface + registry (+ optional Catalog / StreamDefaults) |
+| `uiflow` | Phone-UI primitives app modules drive playback with |
+| `modcfg` | Load an app module's local `module.yaml` + env overrides |
+| `proxy` | Push/start/stop appproxy, CA install/reinject, pull captures |
+| `phonecap` | One phone MITM job (proxy → launch → autoplay → wvkey → session) |
+| `wvkey` | Shells out to `apps/wvkey/wvkey.py` |
+| `brightcove` | Brightcove Playback API + HLS Widevine extraction (platform, not provider) |
+| `capture` | Parse on-device capture JSON + score candidate manifest URLs |
+| `session` | Write `outputs/<app>/<stamp>/` |
+| `mpd` | Manifest rewriter interface, registry, synthetic live MPD builder, local server |
+| `repo` | Find repo root (`apps/pkg/go.mod`) |
+
+Nothing here names a streaming provider. Provider logic lives in `apps/modules/<name>`;
+provider values live in that module's gitignored `module.yaml`.
+
+## Build / test
+
+```bash
+# Go must be on PATH (or set GOROOT)
+go -C apps/pkg test ./...
+```
+
+No binary of its own — everything ships in `bin/drm`, built from `apps/cli`.