Initial commit: RealSense D435 API server

Drop-in replacement for the Nuwa-HP60C camera container, exposing RGB +
aligned depth + intrinsics via REST/WebSocket so the existing
pestello-pose-detector pipeline can consume frames without changes.

Key adaptations for D4xx on USB 2.0 (this robot has no USB 3 port exposed
externally — see STATUS.md):
- pyrealsense2 built from source; the librealsense v2.55.1 install rule
  doesn't ship the main .so, so we copy it from the build dir and add an
  __init__.py that re-exports the submodule.
- Color stream uses YUYV format on USB 2.x (BGR8/RGB8 time out on this
  bus); converted to BGR via cv2.cvtColor in capture().
- rs.align is skipped on USB 2 (incompatible with YUYV); color is
  cv2-resized to depth shape for approximate per-pixel alignment.
- Driver auto-detects usb_type_descriptor and falls back to the
  full-resolution BGR8 + rs.align pipeline when on USB 3.

Tested: /api/{health,status,discover,rgb,depth,depth/color,capture,
intrinsics} all return 200 with valid payloads at 640x480.

.env.example

@@ -0,0 +1,26 @@
+# Server
+API_HOST=0.0.0.0
+API_PORT=8878
+
+# NATS
+NATS_URL=nats://nats:4222
+NATS_TOKEN=
+
+# Service identity
+SERVICE_NAME=realsense-d435
+SERVICE_DOMAIN=vision
+
+# Security — set to a non-empty string to require X-Api-Key on every REST call
+API_KEY=
+
+# RealSense stream
+CAMERA_WIDTH=640
+CAMERA_HEIGHT=480
+CAMERA_FPS=30
+
+# Auto-open the first discovered camera at container startup (1=on, 0=off).
+# With auto-open, the service is fully self-service: no /api/open call needed.
+CAMERA_AUTO_OPEN=1
+
+# CORS — wildcard is OK for a LAN-only service. Tighten if exposed publicly.
+CORS_ORIGINS=*