Fix all PES pipeline audit findings (20 issues)

Critical:
- C1: PES serialize validates track < 256 and data < 4GB
- C2: PES deserialize caps frame size at 256MB (OOM protection)
- C3: TsMuxer stuffing uses static buffer, no per-packet alloc
- C4: PES length uses unbounded (0x0000) for audio >65535 bytes
- C6: TsDemuxer validates AF length <= 183

Warning:
- W1: parse_timestamp validates marker bits, returns Option
- W2: PES header data_start clamped to data.len()
- W3: TsMuxer PTS conversion uses saturating_mul, rejects negative
- W4: AC3/DTS replace debug_assert with runtime bounds check
- W6: MKV block_vint handles 3-4 byte VINTs
- W7: meta.rs to_title() uses unwrap_or fallbacks instead of panic
- W8: MKV reader skips frames for non-existent tracks
- W9: DVD PTS uses higher-precision conversion (1e9/90000)
- FMKV read_header caps JSON at 10MB
- PAT section_len underflow guard

Suggestion:
- S2: TsMuxer uses static STUFF_FF buffer
- S3: HEVC parser single-pass NAL scan (was duplicated)
- S4: TsDemuxer caps remainder at one packet
- S5: PTS 90kHz→ns uses round-to-nearest

src/mux/codec/ac3.rs

@@ -99,7 +99,9 @@ fn find_ac3_sync(data: &[u8]) -> Option<usize> {
 /// bsid is at byte 5, bits 7..3.
 /// AC-3: bsid <= 10, E-AC-3: bsid >= 11 (typically 16).
 pub fn get_bsid(data: &[u8]) -> u8 {
-    debug_assert!(data.len() >= 6);
+    if data.len() < 6 {
+        return 0;
+    }
     (data[5] >> 3) & 0x1F
 }
 
@@ -107,7 +109,9 @@ pub fn get_bsid(data: &[u8]) -> u8 {
 /// frmsiz is at bits [2:0] of byte 2 concatenated with byte 3.
 /// Frame size = (frmsiz + 1) * 2 bytes.
 pub fn eac3_frame_size(data: &[u8]) -> usize {
-    debug_assert!(data.len() >= 4);
+    if data.len() < 4 {
+        return 0;
+    }
     let frmsiz = ((data[2] as usize & 0x07) << 8) | (data[3] as usize);
     (frmsiz + 1) * 2
 }