Initial snapshot: Aliro applet, harness, Nucleo NFC10A1 reader port

Three components, all bench-validated to varying depths:

- applet/: CSA Aliro v1.0 Java Card applet for J3R180. AUTH0 + AUTH1
  expedited-standard flow end-to-end green via PC/SC bench reader
  (aliro-bench-test). Userland AES-256-GCM and HMAC-SHA-256 layered
  on top of J3R180's primitives because the card lacks both natively.
  P-256 curve params seeded explicitly per J3R180's quirk.

- harness/: Python orchestrator (aliro-trustgen, aliro-personalize,
  aliro-bench-test) for trust-bundle generation, card personalization
  via PersonalizationApplet, and PC/SC AUTH0+AUTH1 transactions. 126
  pytest cases passing.

- reader/STM32CubeExpansion_ALIRO_V1_0_0/: ST X-CUBE-ALIRO V1.0.0
  with our NFC10A1 port (NUCLEO-U545RE-Q + X-NUCLEO-NFC10A1, ST25R200
  shared with NFC09A1). nfc10-only/ project, NFC10A1 BSP shim,
  ALIRO_TRUST_OVERRIDE include into vendor's provisioning.c, and an
  ALIRO_APDU_TRACE wrapper around demoTransceiveBlocking. Boots,
  detects the J3R180, completes SELECT + AUTH0; AUTH1 currently fails
  with RFAL ERR_PROTO (0xB) — under investigation, see
  docs/plans/2026-04-20-nucleo-nfc10a1-port.md and bench-notes/.

Excluded: x-cube-aliro.zip vendor archive, harness/.venv, build dirs,
generated aliro_trust.h (contains private reader scalar), all PEMs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,87 @@
+# --- pre-existing ---
+# Local build/test tooling, not committed (jcardsim fork etc.)
+build-tools/
+
+# --- secrets / private keys ---
+# aliro-trustgen emits aliro_trust.h with the reader's PRIVATE scalar.
+# Never commit, anywhere in the tree. Regeneratable from the trust bundle.
+aliro_trust.h
+**/aliro_trust.h
+
+# Trust bundle artifacts (PEMs, group IDs, access docs) — these are produced
+# outside the repo by aliro-trustgen and should never be inside it.
+*.pem
+*.key
+issuer.pem
+reader.pem
+access_credential.pem
+reader_group_id.bin
+reader_group_sub_id.bin
+access_document.bin
+device_response.bin
+
+# Misc credential / env material
+.env
+.env.*
+secrets/
+credentials/
+
+# --- vendor archives (large, redownloadable) ---
+x-cube-aliro.zip
+*.zip
+
+# --- vendor source clones (regeneratable via git clone in setup) ---
+reader/vendor-sources/
+
+# --- Python / harness ---
+**/.venv/
+**/__pycache__/
+**/*.pyc
+**/*.pyo
+**/.pytest_cache/
+**/.mypy_cache/
+**/.ruff_cache/
+**/*.egg-info/
+**/.coverage
+htmlcov/
+harness/dist/
+harness/out/
+
+# --- Java / Maven applet build ---
+applet/target/
+applet/.tools/
+**/*.class
+
+# --- C / firmware build outputs ---
+# CMake/Make/Ninja build dirs anywhere
+**/build/
+**/build-check/
+**/build-debug/
+**/build-release/
+**/CMakeCache.txt
+**/CMakeFiles/
+
+# Compiled outputs (but NOT vendor's precompiled .a libraries — those are
+# distributed as part of X-CUBE-ALIRO and live under Middlewares/ST/*/lib/
+# and Projects/Common/Aliro/Lib/. They are vendor-shipped, not our build
+# output, so we keep them.)
+*.elf
+*.bin
+*.hex
+*.o
+*.obj
+*.lst
+*.map
+*.su
+*.d
+# Java Card .cap (build product of applet/)
+*.cap
+
+# --- IDE / OS ---
+.vscode/
+.idea/
+*.iml
+*.swp
+*.swo
+.DS_Store
+Thumbs.db