Clean up for public release: docs, zero warnings, no hardcoded paths

Documentation:
- docs/aacs.md — AACS encryption (1.0 + 2.0), key resolution, decrypt
- docs/udf.md — UDF 2.50 filesystem with metadata partitions
- docs/mpls.md — MPLS playlist format, STN stream table
- docs/clpi.md — CLPI clip info, EP map, sector extents
- docs/architecture.md — library module map, design principles
- docs/drive-access.md — drive sessions, SCSI transport, unlock

Code cleanup:
- Zero compiler warnings
- Removed all debug eprintln from library code
- No hardcoded private paths — KEYDB tests use KEYDB_PATH env var
- KEYDB search locations as named constants
- drive.rs: extracted create_platform(), deduplicated open methods
- lib.rs: updated doc examples to show Disc::scan() API
- Fixed UDF file reads (partition_start, not metadata_start)
- Exported KeySource from disc module

src/disc.rs

@@ -302,10 +302,16 @@ impl KeySource {
 
 // ─── Disc scanning ──────────────────────────────────────────────────────────
 
+/// Standard KEYDB.cfg search locations (compatible with libaacs).
+const KEYDB_SEARCH_PATHS: &[&str] = &[
+    ".config/aacs/KEYDB.cfg",  // relative to $HOME
+];
+const KEYDB_SYSTEM_PATH: &str = "/etc/aacs/KEYDB.cfg";
+
 /// Options for disc scanning.
 pub struct ScanOptions {
     /// Path to KEYDB.cfg for AACS key lookup.
-    /// If None, tries ~/.config/aacs/KEYDB.cfg and /etc/aacs/KEYDB.cfg.
+    /// If None, searches standard locations ($HOME/.config/aacs/ and /etc/aacs/).
     pub keydb_path: Option<std::path::PathBuf>,
 }
 
@@ -321,17 +327,18 @@ impl ScanOptions {
         ScanOptions { keydb_path: Some(path.into()) }
     }
 
-    /// Resolve KEYDB path: explicit, then standard locations.
+    /// Resolve KEYDB path: explicit path first, then standard locations.
     fn resolve_keydb(&self) -> Option<std::path::PathBuf> {
         if let Some(p) = &self.keydb_path {
             if p.exists() { return Some(p.clone()); }
         }
-        // Standard locations
         if let Some(home) = std::env::var_os("HOME") {
-            let p = std::path::PathBuf::from(home).join(".config/aacs/KEYDB.cfg");
-            if p.exists() { return Some(p); }
+            for relative in KEYDB_SEARCH_PATHS {
+                let p = std::path::PathBuf::from(&home).join(relative);
+                if p.exists() { return Some(p); }
+            }
         }
-        let p = std::path::PathBuf::from("/etc/aacs/KEYDB.cfg");
+        let p = std::path::PathBuf::from(KEYDB_SYSTEM_PATH);
         if p.exists() { return Some(p); }
         None
     }
@@ -426,10 +433,6 @@ impl Disc {
             detail: format!("failed to load KEYDB: {}", e),
         })?;
 
-        let host_cert = keydb.host_cert.as_ref().ok_or_else(|| Error::AacsError {
-            detail: "no host certificate in KEYDB".into(),
-        })?;
-
         // Step 1: Try SCSI handshake for Volume ID + read_data_key
         // Open a separate transport (AACS auth must happen before raw mode).
         // If handshake fails (drive doesn't support AACS layer, e.g. raw-mode drives),