Fix all PES pipeline audit findings (20 issues)

Critical:
- C1: PES serialize validates track < 256 and data < 4GB
- C2: PES deserialize caps frame size at 256MB (OOM protection)
- C3: TsMuxer stuffing uses static buffer, no per-packet alloc
- C4: PES length uses unbounded (0x0000) for audio >65535 bytes
- C6: TsDemuxer validates AF length <= 183

Warning:
- W1: parse_timestamp validates marker bits, returns Option
- W2: PES header data_start clamped to data.len()
- W3: TsMuxer PTS conversion uses saturating_mul, rejects negative
- W4: AC3/DTS replace debug_assert with runtime bounds check
- W6: MKV block_vint handles 3-4 byte VINTs
- W7: meta.rs to_title() uses unwrap_or fallbacks instead of panic
- W8: MKV reader skips frames for non-existent tracks
- W9: DVD PTS uses higher-precision conversion (1e9/90000)
- FMKV read_header caps JSON at 10MB
- PAT section_len underflow guard

Suggestion:
- S2: TsMuxer uses static STUFF_FF buffer
- S3: HEVC parser single-pass NAL scan (was duplicated)
- S4: TsDemuxer caps remainder at one packet
- S5: PTS 90kHz→ns uses round-to-nearest

src/mux/meta.rs

@@ -150,10 +150,10 @@ impl M2tsMeta {
                     codec_private: _,
                 } => Stream::Video(VideoStream {
                     pid: *pid,
-                    codec: codec.parse().unwrap(),
-                    resolution: resolution.parse().unwrap(),
-                    frame_rate: frame_rate.parse().unwrap(),
-                    hdr: hdr.parse().unwrap(),
+                    codec: codec.parse().unwrap_or(crate::disc::Codec::Unknown(0)),
+                    resolution: resolution.parse().unwrap_or(crate::disc::Resolution::Unknown),
+                    frame_rate: frame_rate.parse().unwrap_or(crate::disc::FrameRate::Unknown),
+                    hdr: hdr.parse().unwrap_or(crate::disc::HdrFormat::Sdr),
                     color_space: ColorSpace::Bt709,
                     secondary: *secondary,
                     label: label.clone(),
@@ -168,10 +168,10 @@ impl M2tsMeta {
                     secondary,
                 } => Stream::Audio(AudioStream {
                     pid: *pid,
-                    codec: codec.parse().unwrap(),
-                    channels: channels.parse().unwrap(),
+                    codec: codec.parse().unwrap_or(crate::disc::Codec::Unknown(0)),
+                    channels: channels.parse().unwrap_or(crate::disc::AudioChannels::Unknown),
                     language: language.clone(),
-                    sample_rate: sample_rate.parse().unwrap(),
+                    sample_rate: sample_rate.parse().unwrap_or(crate::disc::SampleRate::Unknown),
                     secondary: *secondary,
                     label: label.clone(),
                 }),
@@ -182,7 +182,7 @@ impl M2tsMeta {
                     forced,
                 } => Stream::Subtitle(SubtitleStream {
                     pid: *pid,
-                    codec: codec.parse().unwrap(),
+                    codec: codec.parse().unwrap_or(crate::disc::Codec::Unknown(0)),
                     language: language.clone(),
                     forced: *forced,
                     codec_data: None,
@@ -256,9 +256,14 @@ pub fn read_header<R: Read + Seek>(r: &mut R) -> io::Result<Option<M2tsMeta>> {
         return Ok(None);
     }
 
+    const MAX_JSON_SIZE: usize = 10 * 1024 * 1024; // 10 MB
+
     let mut len_buf = [0u8; 4];
     r.read_exact(&mut len_buf)?;
     let json_len = u32::from_be_bytes(len_buf) as usize;
+    if json_len > MAX_JSON_SIZE {
+        return Err(io::Error::new(io::ErrorKind::InvalidData, "FMKV JSON too large"));
+    }
 
     let mut json_buf = vec![0u8; json_len];
     r.read_exact(&mut json_buf)?;
@@ -287,9 +292,14 @@ pub fn read_header_from_stream(r: &mut impl Read) -> io::Result<Option<M2tsMeta>
         return Ok(None);
     }
 
+    const MAX_JSON_SIZE: usize = 10 * 1024 * 1024;
+
     let mut len_buf = [0u8; 4];
     r.read_exact(&mut len_buf)?;
     let json_len = u32::from_be_bytes(len_buf) as usize;
+    if json_len > MAX_JSON_SIZE {
+        return Err(io::Error::new(io::ErrorKind::InvalidData, "FMKV JSON too large"));
+    }
 
     let mut json_buf = vec![0u8; json_len];
     r.read_exact(&mut json_buf)?;