Decrypt back in streams — streams handle their own decryption

IsoStream decrypts in its read path using keys from scan.
IOStream trait gets keys() method with default DecryptKeys::None.
Pipeline no longer handles decrypt — just reads decrypted bytes.

src/mux/iso.rs

@@ -9,7 +9,7 @@
 
 use super::isowriter::IsoWriter;
 use super::IOStream;
-use crate::decrypt::DecryptKeys;
+use crate::decrypt::{decrypt_sectors, DecryptKeys};
 use crate::disc::{Disc, DiscTitle, ScanOptions};
 use crate::error::{Error, Result};
 use crate::sector::SectorReader;
@@ -203,7 +203,9 @@ impl IsoStream {
             .read_sectors(lba, count, &mut self.batch_buf)
             .map_err(|e| io::Error::other(e.to_string()))?;
 
+        // Decrypt after read — stream handles its own decryption
         let bytes = count as usize * SECTOR_SIZE as usize;
+        decrypt_sectors(&mut self.batch_buf[..bytes], &self.decrypt_keys, 0);
 
         self.buf_pos = 0;
         self.buf_len = bytes;