Audit fixes + DVD support foundation (IFO, PS demux, MPEG-2, CSS crack)

Audit fixes (14 critical, 22 warnings):
- UDF: bounds checks on all ICB/FID parsing from disc data
- SCSI Linux: saturating_sub on residual, CDB length guard, buffer size guard
- SCSI macOS: SCSITaskStatus u32 (was u8 — stack corruption)
- AACS: EC mod_inv returns infinity instead of panic, key reduced mod n
- AACS: do_handshake tries all host certs (was returning on first failure)
- H.264: bounds check on SPS < 4 bytes
- ContentReader: error on missing unit key (was zero-fill)
- KEYDB: flat redirect loop (was recursive), 100MB response limit, Windows HOME fallback
- ISO writer: AVDP extent order, partition length, allocation cap
- Network: removed TCP_NODELAY on bulk stream
- MKV: guard on u64::MAX seek
- disc.rs: saturating_sub on extent offset, simplified dead region code
- cargo fmt (610 violations), cargo clippy --fix (55 auto-fixes)

DVD support (new files):
- src/ifo.rs — IFO parser (VIDEO_TS.IFO, VTS_XX_0.IFO, PGC chains, cells, streams) — 13 tests
- src/mux/ps.rs — MPEG-2 Program Stream demuxer (pack headers, PES, private stream 1) — 12 tests
- src/mux/codec/mpeg2.rs — MPEG-2 video parser (sequence headers, I-frame detection) — 15 tests
- src/css/crack.rs — split-attack algorithm (LFSR cipher needs verification — test ignored)

226 tests total (was 186), 1 ignored (CSS crack needs cipher verification).

src/lib.rs

@@ -67,43 +67,46 @@
 //! | E6xxx | Disc format errors |
 //! | E7xxx | AACS errors |
 
-pub mod error;
-pub mod sector;
-pub mod scsi;
-pub mod profile;
-pub mod platform;
+pub mod aacs;
+pub mod clpi;
+pub mod css;
+pub mod disc;
 pub mod drive;
+pub mod error;
+pub mod ifo;
+pub mod event;
 pub mod identity;
+pub mod keydb;
+pub mod labels;
+pub mod mpls;
+pub mod mux;
+pub mod platform;
+pub mod profile;
+pub mod scsi;
+pub mod sector;
 pub mod speed;
 pub mod udf;
-pub mod mpls;
-pub mod clpi;
-pub mod disc;
-pub mod aacs;
-pub mod labels;
-pub mod keydb;
-pub mod event;
-pub mod mux;
 
+pub use drive::{find_drive, find_drives, resolve_device, DriveSession};
 pub use error::{Error, Result};
 pub use event::{Event, EventKind};
-pub use drive::{DriveSession, find_drive, find_drives, resolve_device};
 pub use identity::DriveId;
 pub use profile::DriveProfile;
 // Platform trait is pub(crate) -- callers use DriveSession, not Platform directly
-pub use sector::SectorReader;
-pub use scsi::ScsiTransport;
-pub use speed::DriveSpeed;
-pub use disc::{Disc, DiscFormat, DiscTitle, Clip, Stream, VideoStream, AudioStream, SubtitleStream,
-               Codec, HdrFormat, ColorSpace,
-               Extent, ContentReader, AacsState, KeySource, ScanOptions};
-pub use mux::IOStream;
-pub use mux::MkvStream;
-pub use mux::M2tsStream;
-pub use mux::NetworkStream;
+pub use disc::{
+    AacsState, AudioStream, Clip, Codec, ColorSpace, ContentReader, Disc, DiscFormat, DiscTitle,
+    Extent, HdrFormat, KeySource, ScanOptions, Stream, SubtitleStream, VideoStream,
+};
+pub use mux::DiscOptions;
 pub use mux::DiscStream;
+pub use mux::IOStream;
+pub use mux::IsoStream;
+pub use mux::M2tsStream;
+pub use mux::MkvStream;
+pub use mux::NetworkStream;
 pub use mux::NullStream;
 pub use mux::StdioStream;
-pub use mux::IsoStream;
-pub use mux::DiscOptions;
 pub use mux::{open_input, open_output, parse_url, InputOptions};
+pub use scsi::ScsiTransport;
+pub use sector::SectorReader;
+pub use speed::DriveSpeed;