Fix all PES pipeline audit findings (20 issues)

Critical:
- C1: PES serialize validates track < 256 and data < 4GB
- C2: PES deserialize caps frame size at 256MB (OOM protection)
- C3: TsMuxer stuffing uses static buffer, no per-packet alloc
- C4: PES length uses unbounded (0x0000) for audio >65535 bytes
- C6: TsDemuxer validates AF length <= 183

Warning:
- W1: parse_timestamp validates marker bits, returns Option
- W2: PES header data_start clamped to data.len()
- W3: TsMuxer PTS conversion uses saturating_mul, rejects negative
- W4: AC3/DTS replace debug_assert with runtime bounds check
- W6: MKV block_vint handles 3-4 byte VINTs
- W7: meta.rs to_title() uses unwrap_or fallbacks instead of panic
- W8: MKV reader skips frames for non-existent tracks
- W9: DVD PTS uses higher-precision conversion (1e9/90000)
- FMKV read_header caps JSON at 10MB
- PAT section_len underflow guard

Suggestion:
- S2: TsMuxer uses static STUFF_FF buffer
- S3: HEVC parser single-pass NAL scan (was duplicated)
- S4: TsDemuxer caps remainder at one packet
- S5: PTS 90kHz→ns uses round-to-nearest

src/mux/mkvstream.rs

@@ -183,6 +183,11 @@ impl crate::pes::Stream for MkvStream {
                     let pts_ms = rs.cluster_ts_ms + rel_ts as i64;
                     let track_idx = (track as usize).saturating_sub(1); // MKV tracks are 1-based
 
+                    // Skip blocks for non-existent tracks
+                    if track_idx >= self.disc_title.streams.len() {
+                        continue;
+                    }
+
                     return Ok(Some(crate::pes::PesFrame {
                         track: track_idx,
                         pts: pts_ms * 1_000_000, // ms → ns
@@ -689,7 +694,13 @@ fn block_vint(d: &[u8]) -> (u64, usize) {
     if d[0] & 0x40 != 0 && d.len() >= 2 {
         return ((((d[0] & 0x3F) as u64) << 8) | d[1] as u64, 2);
     }
-    (0, 1)
+    if d[0] & 0x20 != 0 && d.len() >= 3 {
+        return ((((d[0] & 0x1F) as u64) << 16) | ((d[1] as u64) << 8) | d[2] as u64, 3);
+    }
+    if d[0] & 0x10 != 0 && d.len() >= 4 {
+        return ((((d[0] & 0x0F) as u64) << 24) | ((d[1] as u64) << 16) | ((d[2] as u64) << 8) | d[3] as u64, 4);
+    }
+    (0, 1) // Unsupported 5+ byte VINT — treat as track 0
 }
 
 /// Convert HEVCDecoderConfigurationRecord (hvcC) to Annex B NAL units.