feat: make DVD playback a classroom surface, not a media player

Pressing DVD now enters DVD mode rather than opening VLC. VLC is still
the backend, because its dvdnav module is what decodes disc menus and
nothing else on Debian does that reliably, but nothing a person can see
or press belongs to it any more.

classroom-dvd-session owns the whole thing. It puts a full-screen black
layer-shell surface up the moment the button is pressed, starts VLC
behind it, and drops it once playback is actually on screen — so the
harsh cut from wallpaper to VLC's black window is gone, and no partial
VLC window or reserved dock strip is ever visible. A deadline drops the
surface regardless, because DVD mode must never leave a black screen
with nothing behind it.

The controls are a classroom bar on the overlay layer, the one layer
sway draws above a fullscreen window. It slides up when the pointer
reaches the bottom of the screen and hides again shortly after it
leaves. It is drawn from the dock's own stylesheet at the room's UI
scale, so it is the same surface, the same radius and the same white
icons. While hidden it only accepts the pointer in a thin strip along
the bottom edge, so a click on a disc menu goes to the disc.

The bar reaches VLC through an HTTP interface on loopback behind a
password generated per session, sending hotkey *actions* by name. That
is what makes the next part possible.

All 108 hotkeys VLC 3.0.23 defines are unset, then Space, Esc and the
arrow keys plus Enter are bound. Crop, aspect ratio, subtitles, audio
tracks and deinterlacing are no longer reachable by pressing a key at
random, and the arrow keys no longer change VLC's volume — the
television owns volume, and CEC will own it properly later.

Esc quits instead of leaving fullscreen. There is nothing to leave, and
leaving it was what stranded people on a black VLC window. Close, Eject
and Esc all ask VLC to quit and escalate to SIGTERM then SIGKILL if it
does not; when VLC exits by any route, including a crash, the session
ends and the classroom desktop comes back.

Verified against VLC 3.0.23 on Trixie: every argument accepted, every
control action accepted over the control interface, a wrong password
refused, and quit exiting cleanly. The surfaces were rendered under a
headless sway and screenshotted to check the bar against the dock.

Co-Authored-By: Claude Opus 5 <[email protected]>

tests/test-classroom-dvd-session.sh

@@ -0,0 +1,112 @@
+#!/bin/bash
+set -uo pipefail
+
+# Checks the VLC launch policy: every hotkey unset, only the classroom
+# ones bound, and the control interface wired to this session only.
+#
+#   tests/test-classroom-dvd-session.sh
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+PYTHONPATH="$ROOT/lib" python3 - "$ROOT" <<'PY'
+import sys
+
+sys.path.insert(0, sys.argv[1] + "/lib")
+
+import classroom_vlc as vlc
+
+passed = failed = 0
+
+
+def check(label, condition, detail=""):
+    global passed, failed
+    if condition:
+        print(f"  ok   {label}")
+        passed += 1
+    else:
+        print(f"  FAIL {label}")
+        if detail:
+            print(f"       {detail}")
+        failed += 1
+
+
+command = vlc.player_command("/dev/sr0", 41234, "s3cret")
+
+print("1. every VLC hotkey is unset")
+
+check("VLC 3.0.23 defines 108 hotkeys", len(vlc.ALL_HOTKEYS) == 108,
+      f"got {len(vlc.ALL_HOTKEYS)}")
+check("no duplicates in the hotkey list",
+      len(set(vlc.ALL_HOTKEYS)) == len(vlc.ALL_HOTKEYS))
+
+unset = [a for a in command if a.startswith("--key-") and a.endswith("=")]
+check("one unset per hotkey", len(unset) == len(vlc.ALL_HOTKEYS),
+      f"{len(unset)} unsets for {len(vlc.ALL_HOTKEYS)} hotkeys")
+
+# The specific complaints from hardware testing.
+for name in ("crop", "aspect-ratio", "vol-up", "vol-down", "vol-mute",
+             "subtitle-track", "audio-track", "deinterlace",
+             "toggle-fullscreen", "leave-fullscreen"):
+    check(f"{name} is unset", f"--key-{name}=" in command)
+
+print()
+print("2. only the classroom keys are bound")
+
+bound = {a.split("=", 1)[0][len("--key-"):]: a.split("=", 1)[1]
+         for a in command
+         if a.startswith("--key-") and not a.endswith("=")}
+
+check("bound set is exactly the classroom set",
+      bound == vlc.CLASSROOM_HOTKEYS, f"got {bound}")
+check("Space is play/pause", bound.get("play-pause") == "Space")
+check("Esc quits rather than leaving fullscreen",
+      bound.get("quit") == "Esc")
+check("arrow keys are disc navigation, not volume",
+      bound.get("nav-up") == "Up" and bound.get("nav-down") == "Down")
+check("Enter activates a menu item", bound.get("nav-activate") == "Enter")
+check("nothing bound to volume",
+      not any(k.startswith("vol-") for k in bound))
+check("no fullscreen toggle: DVD mode is the whole screen",
+      "toggle-fullscreen" not in bound and "leave-fullscreen" not in bound)
+
+print()
+print("3. unsets come before the bindings, so the bindings win")
+
+first_binding = min(i for i, a in enumerate(command)
+                    if a.startswith("--key-") and not a.endswith("="))
+last_unset = max(i for i, a in enumerate(command) if a.endswith("=")
+                 and a.startswith("--key-"))
+check("every unset precedes every binding", last_unset < first_binding,
+      f"last unset {last_unset}, first binding {first_binding}")
+
+print()
+print("4. VLC's own interface is switched off")
+
+for option in ("--qt-minimal-view", "--no-qt-fs-controller", "--no-qt-bgcone",
+               "--no-qt-system-tray", "--no-video-title-show", "--fullscreen",
+               "--qt-dark-palette"):
+    check(f"{option} passed", option in command)
+
+print()
+print("5. the control interface belongs to this session alone")
+
+check("bound to loopback only",
+      command[command.index("--http-host") + 1] == "127.0.0.1")
+check("uses the port it was given",
+      command[command.index("--http-port") + 1] == "41234")
+check("uses the password it was given",
+      command[command.index("--http-password") + 1] == "s3cret")
+check("passwords are not reused",
+      vlc.control_password() != vlc.control_password())
+check("passwords are long enough to matter",
+      len(vlc.control_password()) >= 24)
+
+print()
+print("6. the disc is the last argument")
+
+check("dvd:// selects dvdnav for menus", command[-1] == "dvd:///dev/sr0")
+
+print()
+print(f"passed: {passed}  failed: {failed}")
+sys.exit(1 if failed else 0)
+PY