Initial commit: Null DRM Official

Capture, decrypt, and restream toolkit with compiled-in app modules
(RTE, TG4, BBC), on-device MITM proxy, streamd control plane, and www.
BBC module.yaml is published (clear streams); other module values stay local.

docs/providers/bbc.md

@@ -0,0 +1,58 @@
+# BBC module — filling in `module.yaml`
+
+BBC iPlayer (Android). Streams from the `mobile-phone-main` mediaset are **clear**
+(CDN signed URLs); capture only needs the **MPD/HLS master**. Transparent MITM keeps
+NordVPN UK on the phone.
+
+`apps/modules/bbc/module.yaml` is published in the repo (package + channel map only;
+no secrets). Skeleton:
+
+```yaml
+package: bbc.iplayer.android
+proxy_bin: bin/proxy-android-arm64
+ca_hash: "6c3578b4"
+
+score:
+  hosts:
+    - open.live.bbc.co.uk
+    - vs-cmaf-push-uk
+    - vod-dash-uk
+    - akamaized.net
+    - bbci.co.uk
+    - bidi.net.uk
+  deny:
+    - telemetry.api.bbci
+    - bag.api.bbc
+    - thumbnail
+
+aliases:
+  one: bbcone
+  bbc1: bbcone
+
+channels:
+  bbcone:
+    label: BBC One
+    vpid: bbc_one_london
+  bbctwo:
+    label: BBC Two
+    vpid: bbc_two_england
+```
+
+## Capture
+
+```bash
+# Leave NordVPN UK ON. Magisk CA should already be mounted (skip --reinject).
+./bin/drm capture --app bbc --channel bbcone --wait 120
+# Play BBC One on the phone when prompted.
+```
+
+Console prints the MPD in a banner; `outputs/bbc/<stamp>/session.json` holds the
+same fields (`mpd` required; no `key` / `pssh` for clear streams).
+
+Replay:
+
+```powershell
+ffplay -user_agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0 Safari/537.36" -i "<mpd url>"
+```
+
+PC needs a UK egress IP (VPN). Some CDNs reject HEAD; use GET / ffplay as above.