ktprdCdm

Serve a ktprd CDM over the HTTP protocol pyplayready serve defines, so that either client — ktprd-remote's RemotePlayreadyCdm or pyplayready's — can drive it.

This installs routes only; the caller owns the engine and may mount it anywhere:

embeddedServer(CIO, port = 7723) {
    routing { ktprdCdm(config) }
}.start(wait = true)

Callers authenticate with an X-Secret-Key header. A device's private keys never leave this process, so treat the secret keys as credentials and serve this over TLS.