Audit v3 fixes: all 3 tiers (19 findings)

Tier 1 (compilation + correctness):
- Fix nightly-only is_multiple_of → % 2 != 0 (stable Rust compat)
- Fix parse_sample_rate: check 192 before 96 (was returning wrong rate)
- macOS drive discovery: split unix.rs → linux.rs + macos.rs
- Linux: EACCES returns DevicePermission not DeviceNotFound
- CLI pipe.rs: Ctrl+C signal handler added

Tier 2 (correctness + security):
- MkvStream: reset demuxer after scanning→streaming transition
- Windows SPTI: zero data buffer before ioctl
- AACS cert verification: documented why silently skipped
- KEYDB: HOME + USERPROFILE fallback for Windows
- Library modules: pub(crate) for internal modules
- AACS: explicit re-exports, AES primitives pub(crate)

Tier 3 (performance + polish):
- IsoStream: batch 64-sector reads (was 1 sector at a time)
- DiscStream: buffer swap instead of copy in decrypt_and_buffer
- Vec capacity hints in TS/PS demuxer hot paths
- NetworkStream: TLS warning documented
- Batch rip: per-title progress display
- cargo fmt: 0 violations

319 tests, 0 fmt violations.

src/mux/mkvstream.rs

@@ -333,10 +333,12 @@ fn begin_streaming(ws: &mut WriteState, dt: &DiscTitle) -> io::Result<()> {
     )?);
     ws.phase = WritePhase::Streaming;
 
-    // Re-parse buffered data through a fresh demuxer
+    // Re-parse buffered data through a fresh demuxer, then reset the main
+    // demuxer so stale PES assembler state from scanning doesn't cause
+    // duplicate or incomplete packets during streaming.
+    let pids: Vec<u16> = ws.pid_to_track.iter().map(|(pid, _)| *pid).collect();
     let buffered = ws.lookahead.drain();
     if !buffered.is_empty() {
-        let pids: Vec<u16> = ws.pid_to_track.iter().map(|(pid, _)| *pid).collect();
         let mut temp = TsDemuxer::new(&pids);
         let packets = temp.feed(&buffered);
         if let Some(ref mut muxer) = ws.muxer {
@@ -345,6 +347,7 @@ fn begin_streaming(ws: &mut WriteState, dt: &DiscTitle) -> io::Result<()> {
             }
         }
     }
+    ws.demuxer = TsDemuxer::new(&pids);
     Ok(())
 }