🔐 Encrypted chunk player — AES-256-GCM · MSE

Fetches encrypted CMAF chunks, decrypts each in the browser with Web Crypto, and feeds them to Media Source Extensions.

Manifest URL (R2 via same-origin proxy: /manifest · local files: /media/manifest.json) Key endpoint (out-of-band content key)