Audit fixes + DVD support foundation (IFO, PS demux, MPEG-2, CSS crack)

Audit fixes (14 critical, 22 warnings):
- UDF: bounds checks on all ICB/FID parsing from disc data
- SCSI Linux: saturating_sub on residual, CDB length guard, buffer size guard
- SCSI macOS: SCSITaskStatus u32 (was u8 — stack corruption)
- AACS: EC mod_inv returns infinity instead of panic, key reduced mod n
- AACS: do_handshake tries all host certs (was returning on first failure)
- H.264: bounds check on SPS < 4 bytes
- ContentReader: error on missing unit key (was zero-fill)
- KEYDB: flat redirect loop (was recursive), 100MB response limit, Windows HOME fallback
- ISO writer: AVDP extent order, partition length, allocation cap
- Network: removed TCP_NODELAY on bulk stream
- MKV: guard on u64::MAX seek
- disc.rs: saturating_sub on extent offset, simplified dead region code
- cargo fmt (610 violations), cargo clippy --fix (55 auto-fixes)

DVD support (new files):
- src/ifo.rs — IFO parser (VIDEO_TS.IFO, VTS_XX_0.IFO, PGC chains, cells, streams) — 13 tests
- src/mux/ps.rs — MPEG-2 Program Stream demuxer (pack headers, PES, private stream 1) — 12 tests
- src/mux/codec/mpeg2.rs — MPEG-2 video parser (sequence headers, I-frame detection) — 15 tests
- src/css/crack.rs — split-attack algorithm (LFSR cipher needs verification — test ignored)

226 tests total (was 186), 1 ignored (CSS crack needs cipher verification).

src/mux/codec/truehd.rs

@@ -6,12 +6,20 @@
 //! All access units are keyframes.
 //! Each PES packet = one access unit.
 
-use super::{CodecParser, Frame, PesPacket, pts_to_ns};
+use super::{pts_to_ns, CodecParser, Frame, PesPacket};
 
 pub struct TrueHdParser;
 
+impl Default for TrueHdParser {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl TrueHdParser {
-    pub fn new() -> Self { Self }
+    pub fn new() -> Self {
+        Self
+    }
 }
 
 impl CodecParser for TrueHdParser {
@@ -20,10 +28,16 @@ impl CodecParser for TrueHdParser {
             return Vec::new();
         }
         let pts_ns = pes.pts.map(pts_to_ns).unwrap_or(0);
-        vec![Frame { pts_ns, keyframe: true, data: pes.data.clone() }]
+        vec![Frame {
+            pts_ns,
+            keyframe: true,
+            data: pes.data.clone(),
+        }]
     }
 
-    fn codec_private(&self) -> Option<Vec<u8>> { None }
+    fn codec_private(&self) -> Option<Vec<u8>> {
+        None
+    }
 }
 
 #[cfg(test)]
@@ -32,7 +46,12 @@ mod tests {
     use crate::mux::ts::PesPacket;
 
     fn make_pes(data: Vec<u8>, pts: Option<i64>) -> PesPacket {
-        PesPacket { pid: 0x1100, pts, dts: None, data }
+        PesPacket {
+            pid: 0x1100,
+            pts,
+            dts: None,
+            data,
+        }
     }
 
     #[test]