Audit v3 fixes: all 3 tiers (19 findings)

Tier 1 (compilation + correctness):
- Fix nightly-only is_multiple_of → % 2 != 0 (stable Rust compat)
- Fix parse_sample_rate: check 192 before 96 (was returning wrong rate)
- macOS drive discovery: split unix.rs → linux.rs + macos.rs
- Linux: EACCES returns DevicePermission not DeviceNotFound
- CLI pipe.rs: Ctrl+C signal handler added

Tier 2 (correctness + security):
- MkvStream: reset demuxer after scanning→streaming transition
- Windows SPTI: zero data buffer before ioctl
- AACS cert verification: documented why silently skipped
- KEYDB: HOME + USERPROFILE fallback for Windows
- Library modules: pub(crate) for internal modules
- AACS: explicit re-exports, AES primitives pub(crate)

Tier 3 (performance + polish):
- IsoStream: batch 64-sector reads (was 1 sector at a time)
- DiscStream: buffer swap instead of copy in decrypt_and_buffer
- Vec capacity hints in TS/PS demuxer hot paths
- NetworkStream: TLS warning documented
- Batch rip: per-title progress display
- cargo fmt: 0 violations

319 tests, 0 fmt violations.

src/scsi/linux.rs

@@ -55,8 +55,18 @@ impl SgIoTransport {
             )
         };
         if fd < 0 {
-            return Err(Error::DeviceNotFound {
-                path: device.display().to_string(),
+            let err = std::io::Error::last_os_error();
+            return Err(if err.kind() == std::io::ErrorKind::PermissionDenied {
+                Error::DevicePermission {
+                    path: format!(
+                        "{}: permission denied (try running as root)",
+                        device.display()
+                    ),
+                }
+            } else {
+                Error::DeviceNotFound {
+                    path: device.display().to_string(),
+                }
             });
         }
         Ok(SgIoTransport { fd })

src/scsi/windows.rs

@@ -88,6 +88,10 @@ pub struct SptiTransport {
 }
 
 /// Normalize a device path to Windows \\.\X: format.
+///
+/// NOTE: A near-identical `normalize_path` exists in `drive::windows`.
+/// Both are kept because they live in separate `cfg(windows)` modules that
+/// cannot easily share a helper without introducing cross-module coupling.
 fn normalize_device_path(path: &str) -> String {
     if path.starts_with("\\\\.\\") {
         return path.to_string();
@@ -150,6 +154,12 @@ impl ScsiTransport for SptiTransport {
         data: &mut [u8],
         timeout_ms: u32,
     ) -> Result<ScsiResult> {
+        // Zero the data buffer for reads to prevent returning uninitialized data
+        // if the driver doesn't fully update DataTransferLength.
+        if direction == DataDirection::FromDevice {
+            data.fill(0);
+        }
+
         let mut sptwb: SptwbDirect = unsafe { std::mem::zeroed() };
 
         let cdb_len = cdb.len().min(K_MAX_CDB_SIZE);