Distinguish a failed key source from one with no entry

resolve_and_apply_traced collapsed `Ok(_) | Err(_)` into a single
KeyNode::NoEntry step, so a key source that FAILED — server unreachable, keydb
unreadable, malformed entry — was recorded identically to one that simply had no
entry for this disc. The front-end renders that trace, so it told the operator
their disc is not in the database when the real cause was a fixable
infrastructure problem. drive_unit_keys and drive_fmts_indexes were refactored
this cycle to preserve exactly this distinction; this path had not been.

KeyNode gains a SourceFailed variant and the two arms are split. freemkv's
trace renderer matches KeyNode exhaustively with no catch-all, so its arm is
added in the same change — otherwise the consumer would not build.

Also made ETSI TS 102 114 the primary authority for DTS_AMODE_COUNT's comment
rather than a reference decoder internal symbol, and pointed it at this
crate's own cross-checked DTS_AMODE_LAYOUT / DTS_AMODE_CH tables.

A round-2 finding asked for every a reference decoder and a reference decoder citation in the DTS parser
to be stripped as a public-repo hygiene violation. Rejected: the project's rules
(scan-secrets.sh, CLAUDE.md) prohibit internal infrastructure references and
reverse-engineering material, and a reference-decoder citation is neither. The
AMODE channel-count table is a factual table from the standard, not expression
copied from an implementation. Citing the spec plus a corroborating
implementation is how a decodability gate should be justified.

src/aacs/trace.rs

@@ -77,6 +77,11 @@ pub enum KeyNode {
     MatchedDisc,
     /// The source had no entry for this disc.
     NoEntry,
+    /// The source FAILED — it errored rather than reporting no entry. Distinct
+    /// from [`Self::NoEntry`]: an unreachable key server or an unreadable keydb is
+    /// a fixable condition, whereas "this disc is not in the database" is not, and
+    /// collapsing the two told the front-end the wrong cause.
+    SourceFailed,
     /// Pre-decrypted unit keys were found.
     FoundUnitKeys,
     /// A VUK was found.