feat: detect and play DVDs where a drive is fitted

DVD support stays optional per room: DVD_ENABLED decides whether the
button is built at all, and rooms without it poll nothing. Upgrades
append a commented DVD_ENABLED=false so the option is discoverable
without changing what those rooms already do.

The dock polls the drive with CDROM_DRIVE_STATUS, which is a status
query rather than a read, so it does not spin the disc up. A disc that
becomes ready announces itself once and brings the DVD logo up to full
strength; an empty or unplugged drive holds it back, the same gray
versus colour language the LIVE icon already uses. Nothing autoplays —
playback always needs a deliberate press.

Playback is VLC rather than mpv because mpv dropped DVD menu support,
and menus are the part that matters for a commercial disc. It goes
through classroom-window like everything else, so the player minimizes
and restores from the dock exactly as the browser does.

Pressing the button with no drive, no disc, or a disc still spinning up
gives a plain-language notification instead of failing silently.

Reading the drive needs group cdrom, which the postinst grants and the
OTA reboot activates. Commercial CSS discs additionally need libdvdcss,
which Debian cannot ship; classroom-dvd-css-setup bootstraps it from
contrib. That is deliberately not run from the postinst, which executes
while dpkg already holds the apt lock.

The optical helpers live in a shared module both the dock and
classroom-dvd import, and the dock imports it defensively: if it ever
goes missing the shell loses disc detection rather than failing to
start.

Co-Authored-By: Claude Opus 5 <[email protected]>

scripts/classroom-dvd-css-setup

@@ -0,0 +1,61 @@
+#!/bin/bash
+set -euo pipefail
+
+# One-time bootstrap for encrypted (commercial) DVD-Video playback.
+#
+# Most retail DVDs are CSS encrypted. Debian cannot ship the decryption
+# library, so libdvdcss has to be built on the machine from the contrib
+# package libdvd-pkg. This is deliberately NOT run from the package
+# postinst: it needs the network, it compiles a package, and it must not
+# run while dpkg already holds the apt lock during an OTA update.
+#
+# Run this once, as root, on any classroom that needs commercial discs:
+#
+#     sudo classroom-dvd-css-setup
+#
+# Unencrypted discs (church curriculum, home-burned video) play without it.
+
+if [[ "$(id -u)" -ne 0 ]]; then
+    echo "classroom-dvd-css-setup must be run as root." >&2
+    exit 1
+fi
+
+if [[ -e /usr/lib/x86_64-linux-gnu/libdvdcss.so.2 ]]; then
+    echo "libdvdcss is already installed. Nothing to do."
+    exit 0
+fi
+
+echo "Enabling the Debian contrib component..."
+
+if ! grep -rqs 'contrib' /etc/apt/sources.list /etc/apt/sources.list.d/; then
+    if [[ -f /etc/apt/sources.list.d/debian.sources ]]; then
+        sed -i 's/^\(Components:.*\)$/\1 contrib/' \
+            /etc/apt/sources.list.d/debian.sources
+    else
+        echo "Could not find a Debian sources file to add contrib to." >&2
+        echo "Add 'contrib' manually and re-run this script." >&2
+        exit 1
+    fi
+fi
+
+echo "Installing libdvd-pkg..."
+
+export DEBIAN_FRONTEND=noninteractive
+
+apt-get update
+apt-get install -y libdvd-pkg
+
+echo "Building libdvdcss..."
+
+# libdvd-pkg downloads and builds libdvdcss during reconfigure.
+dpkg-reconfigure -f noninteractive libdvd-pkg
+
+if [[ -e /usr/lib/x86_64-linux-gnu/libdvdcss.so.2 ]]; then
+    echo
+    echo "libdvdcss installed. Commercial DVDs should now play."
+    echo "Test with an actual disc before relying on it."
+else
+    echo
+    echo "libdvdcss was not installed. Commercial discs will not play." >&2
+    exit 1
+fi