libfreemkv: clip-anchored AACS unit gate + consolidate key mechanism

The AACS unit-alignment gate measured `lba % 3` against absolute disc LBA 0,
but aligned units are anchored at each clip's encrypted-region start. A clip
whose start_lba is not 3-aligned had its readable units wrongly rejected with
"Decryption failed" (the big-title-only failure on some Blu-rays). One
canonical clip-anchored helper (`aacs::is_unit_aligned`) is now the single
source of truth for the decrypt-on-read gate; both mux read paths set the
per-extent `unit_base = start_lba` via a new `SectorSource::set_unit_base`.

Also moves key *mechanism* into the library: the encrypted sample reader
(`read_encrypted_units`) and the candidate-key resolution loop
(`resolve_and_apply`) now live here, so a key source is purely a lookup.
Regression test covers a clip based at a non-3-aligned LBA.

src/sector/mod.rs

@@ -56,6 +56,17 @@ pub trait SectorSource: Send {
     /// Optional speed control for sources that map to a physical
     /// drive. No-op for everything else.
     fn set_speed(&mut self, _kbs: u16) {}
+
+    /// Set the base LBA an AACS unit-alignment gate measures against — the
+    /// `start_lba` of the extent/clip about to be read. Aligned AACS units
+    /// (6144 B / 3 sectors) are anchored at each clip's encrypted-region start,
+    /// so a decrypt-on-read source gates `lba` relative to this base, not
+    /// absolute disc LBA 0. Mux read paths call this when they advance to a new
+    /// extent. No-op for everything except [`DecryptingSectorSource`], the only
+    /// source that applies the unit-alignment gate.
+    ///
+    /// [`DecryptingSectorSource`]: crate::sector::DecryptingSectorSource
+    fn set_unit_base(&mut self, _lba: u32) {}
 }
 
 // Forwarding impls so `Box<dyn SectorSource>` and `&mut dyn SectorSource`