[playbridgeapp]

Phase 1 of Watch Together (docs/design-watch-together.md): the Rust engine from #532, bridged into the Android TV and phone apps.

What's in it

FFI and engine

• cast/ffi together feature: pb_together_* JSON handle plus JNI (TogetherNative), the pairing code's QR as modules, and an explicit rustls/webpki config (the Android platform verifier needs JNI setup, and both ring and aws-lc are linked).
• Engine:
  • A TV paired by code counts as the inviting phone's own device (it gets its sign-ins).
  • A member can switch between screen and remote mid-party.
  • The party pauses at the end of the video, and the corrector never seeks a device past its own end. Live streams report no length and never end.
  • Gaps under 500 ms are left alone while paused. Players keep no back buffer (low-RAM TVs), so any seek back reloads the video.
  • A Play while already playing, or a Pause while paused, is ignored, so repeated taps don't push a scheduled start back.

TV

• Settings → Watch Together: code and QR, a join prompt, party state, and a pairing service setting.
• Party mode in the player:
  • The video loads paused and the room starts it.
  • No history or resume points.
  • Remote controls go to the party.
  • Back or Home leaves the party.
• Joins without a prompt when its paired phone adds it over the LAN (watch_together_join / watch_together_joined, capability watch_together_v1).

Phone

• Dashboard → Watch together:
  • Start or join a party, and share the invite.
  • Add the connected TV, or another TV by its code.
  • Play, pause and seek.
  • Lock, who can change the video, Allow/Deny requests, and share my sign-in.
• Invite links open the party: tapped links, plus "Open in PlayBridge" on the invite page.
• While in a party, a video tapped in the cast sheet plays in the party.
• "Watch on this phone":
  • Plays along in the phone player, whose controls go to the party.
  • On by default when the phone isn't connected to a TV.
  • Can be switched mid-party. Closing the player turns the phone back into a remote.

Tested

• Mac CLI host with the Hisense:
  • code and QR, invite, then join;
  • synced start, plus pause, seek and resume from the host;
  • pause from the TV remote reaches the host;
  • Back leaves the party;
  • no trace of the video URL in the TV app's storage.
• Mac CLI host with the Samsung:
  • join by link, as a remote and as a screen;
  • player controls go to the party, and the party waits while the phone buffers;
  • the video ends cleanly at the end, with no seek loop.
• Checks: Rust fmt, workspace clippy, together-feature clippy and tests, together crate and simulation tests (new ones for switching to watching, the end of the video, and repeated taps), phone shared and unit tests, TV unit tests and build, room Worker typecheck and tests.

Not tested on a device

• The TV's latest changes (waiting to hear whether a stream is live before reporting its length), and the TV and the phone watching in the same party.

Not in this PR

• Web-page and Bridged App sources (direct links only, on both apps).
• Adding several paired TVs at once.
• The shared relay and pairing URLs are on the amehla workers.dev subdomain until a PlayBridge domain is decided.
• The TV's native library grows from about 5.2 MB to 10.5 MB (arm64).