Audit fixes + DVD support foundation (IFO, PS demux, MPEG-2, CSS crack)

Audit fixes (14 critical, 22 warnings):
- UDF: bounds checks on all ICB/FID parsing from disc data
- SCSI Linux: saturating_sub on residual, CDB length guard, buffer size guard
- SCSI macOS: SCSITaskStatus u32 (was u8 — stack corruption)
- AACS: EC mod_inv returns infinity instead of panic, key reduced mod n
- AACS: do_handshake tries all host certs (was returning on first failure)
- H.264: bounds check on SPS < 4 bytes
- ContentReader: error on missing unit key (was zero-fill)
- KEYDB: flat redirect loop (was recursive), 100MB response limit, Windows HOME fallback
- ISO writer: AVDP extent order, partition length, allocation cap
- Network: removed TCP_NODELAY on bulk stream
- MKV: guard on u64::MAX seek
- disc.rs: saturating_sub on extent offset, simplified dead region code
- cargo fmt (610 violations), cargo clippy --fix (55 auto-fixes)

DVD support (new files):
- src/ifo.rs — IFO parser (VIDEO_TS.IFO, VTS_XX_0.IFO, PGC chains, cells, streams) — 13 tests
- src/mux/ps.rs — MPEG-2 Program Stream demuxer (pack headers, PES, private stream 1) — 12 tests
- src/mux/codec/mpeg2.rs — MPEG-2 video parser (sequence headers, I-frame detection) — 15 tests
- src/css/crack.rs — split-attack algorithm (LFSR cipher needs verification — test ignored)

226 tests total (was 186), 1 ignored (CSS crack needs cipher verification).

src/mux/mod.rs

@@ -19,32 +19,34 @@
 //! output.finish()?;
 //! ```
 
-pub mod ebml;
-pub mod ts;
-pub mod mkv;
 pub mod codec;
+pub mod disc;
+pub mod ebml;
+pub mod iso;
+mod isowriter;
 pub mod lookahead;
-pub mod meta;
 mod m2ts;
+pub mod meta;
+pub mod mkv;
 mod mkvstream;
 pub mod network;
-pub mod disc;
 pub mod null;
-pub mod stdio;
-pub mod iso;
 pub mod resolve;
+pub mod stdio;
+pub mod ps;
+pub mod ts;
 
+pub use disc::{DiscOptions, DiscStream};
+pub use iso::IsoStream;
 pub use m2ts::M2tsStream;
 pub use mkvstream::MkvStream;
 pub use network::NetworkStream;
-pub use disc::{DiscStream, DiscOptions};
 pub use null::NullStream;
-pub use stdio::StdioStream;
-pub use iso::IsoStream;
 pub use resolve::{open_input, open_output, parse_url, InputOptions, StreamUrl};
+pub use stdio::StdioStream;
 
-use std::io::{self, Read, Write, Seek};
 use crate::disc::DiscTitle;
+use std::io::{self, Read, Seek, Write};
 
 /// Common interface for all stream types.
 ///