feat: detect and play DVDs where a drive is fitted

DVD support stays optional per room: DVD_ENABLED decides whether the
button is built at all, and rooms without it poll nothing. Upgrades
append a commented DVD_ENABLED=false so the option is discoverable
without changing what those rooms already do.

The dock polls the drive with CDROM_DRIVE_STATUS, which is a status
query rather than a read, so it does not spin the disc up. A disc that
becomes ready announces itself once and brings the DVD logo up to full
strength; an empty or unplugged drive holds it back, the same gray
versus colour language the LIVE icon already uses. Nothing autoplays —
playback always needs a deliberate press.

Playback is VLC rather than mpv because mpv dropped DVD menu support,
and menus are the part that matters for a commercial disc. It goes
through classroom-window like everything else, so the player minimizes
and restores from the dock exactly as the browser does.

Pressing the button with no drive, no disc, or a disc still spinning up
gives a plain-language notification instead of failing silently.

Reading the drive needs group cdrom, which the postinst grants and the
OTA reboot activates. Commercial CSS discs additionally need libdvdcss,
which Debian cannot ship; classroom-dvd-css-setup bootstraps it from
contrib. That is deliberately not run from the postinst, which executes
while dpkg already holds the apt lock.

The optical helpers live in a shared module both the dock and
classroom-dvd import, and the dock imports it defensively: if it ever
goes missing the shell loses disc detection rather than failing to
start.

Co-Authored-By: Claude Opus 5 <[email protected]>

packaging/debian/postinst

@@ -19,19 +19,40 @@ chmod 0644 /home/classroom/.bash_profile
 
 chmod 0755 /usr/local/bin/classroom-browser
 chmod 0755 /usr/local/bin/classroom-window
+chmod 0755 /usr/local/bin/classroom-dvd
+chmod 0755 /usr/local/bin/classroom-dvd-css-setup
 chmod 0755 /usr/local/bin/classroom-notify-test
 
+# Reading the optical drive needs group cdrom. Takes effect at the next
+# login, which the OTA reboot provides.
+if getent group cdrom >/dev/null 2>&1; then
+    adduser classroom cdrom >/dev/null 2>&1 || true
+fi
+
 if [ ! -f /etc/ekklesia-classroom/device.conf ]; then
     cat > /etc/ekklesia-classroom/device.conf <<'CONFIG'
 # Ekklesia Classroom device configuration
 
 UPDATE_URL=https://updates.riverofglorymn.org
 CHANNEL=stable
+
+# Set to true on classrooms that have a DVD drive.
+DVD_ENABLED=false
 CONFIG
 
     chmod 0644 /etc/ekklesia-classroom/device.conf
 fi
 
+# Make the DVD option discoverable on classrooms installed before it
+# existed. false is what those rooms already do, so nothing changes.
+if ! grep -q '^DVD_ENABLED=' /etc/ekklesia-classroom/device.conf; then
+    cat >> /etc/ekklesia-classroom/device.conf <<'CONFIG'
+
+# Set to true on classrooms that have a DVD drive.
+DVD_ENABLED=false
+CONFIG
+fi
+
 systemctl daemon-reload || true
 
 systemctl enable ekklesia-classroom-update.timer || true