aacs: remove boil veneer; move key newtypes to aacs::types

aacs::boil was a thin newtype veneer over aacs::derive — a duplicate layer.
Delete it: move the shared key newtypes (Vid, MediaKey, Vuk, ProcessingKey,
UnitKey) into aacs::types, and expose resolve_candidate + KeyCandidate from
aacs::derive directly. Downstream (keysource, disc::encrypt) now import from
aacs::{derive,types}. Pure API consolidation, no behaviour change; full test
suite green on Rust 1.86.

src/disc/encrypt.rs

@@ -983,7 +983,7 @@ mod tests {
         fn get_uk(
             &self,
             _ctx: &dyn crate::keysource::ResolveCtx,
-        ) -> Result<Vec<crate::aacs::boil::UnitKey>> {
+        ) -> Result<Vec<crate::aacs::types::UnitKey>> {
             Ok(Vec::new())
         }
         fn host_certs(&self, _mkb: Option<u32>) -> Vec<aacs::types::HostCert> {