Initial commit: Null DRM Official

Capture, decrypt, and restream toolkit with compiled-in app modules
(RTE, TG4, BBC), on-device MITM proxy, streamd control plane, and www.
BBC module.yaml is published (clear streams); other module values stay local.

docs/README.md

@@ -0,0 +1,40 @@
+# Documentation
+
+| Doc | Read it when |
+|---|---|
+| [quickstart.md](quickstart.md) | You just cloned the repo and want something working |
+| [architecture.md](architecture.md) | You want to know how the pieces fit and why |
+| [modules.md](modules.md) | You are adding support for a new streaming app |
+| [capture.md](capture.md) | You need to discover an app's URLs, IDs and UI selectors |
+| [streamd.md](streamd.md) | You are running the control plane + agent |
+| [providers/rte.md](providers/rte.md) | You are filling in `apps/modules/rte/module.yaml` |
+| [providers/tg4.md](providers/tg4.md) | You are filling in `apps/modules/tg4/module.yaml` |
+
+## The one idea worth knowing first
+
+The repo separates **logic** from **values**:
+
+```text
+apps/modules/tg4/*.go          tracked.   How to drive the app. No secrets, ever.
+apps/modules/tg4/module.yaml   gitignored. Account IDs, policy keys, video IDs, KIDs.
+```
+
+Both module packages have a test asserting an empty config yields empty
+credentials, so the separation is checked rather than merely intended:
+
+```bash
+go -C apps/modules test ./... -run NoHardcoded -v
+```
+
+A fresh clone therefore builds and runs, but knows no channels until you supply
+your own values. Each `providers/*.md` doc explains where to get them.
+
+## Build
+
+```bash
+go -C apps/cli build -o ../../bin/drm .      # Windows: -o ../../bin/drm.exe
+./bin/drm proxy build                        # once, for phone capture
+```
+
+There is no build script and no Makefile — `go build` is the build system.
+[quickstart.md](quickstart.md) lists every command.