aacs: split keys.rs god-module into media_key/volume_key/inf/resolve

Break the 2800-line keys.rs into four responsibility-scoped modules:
- media_key.rs: DK/PK -> Media Key subset-difference walk (+ probe harness)
- volume_key.rs: VUK derivation, unit-key unwrap
- inf.rs: Unit_Key_RO.inf parsing, disc_hash, content cert, in-drive MKB read
- resolve.rs: the resolve_keys_* orchestration (keys.rs renamed)

Relocation only; the (white-box) test suite stays in resolve.rs and pulls
the moved items via glob imports. Proven byte-identical to the pre-refactor
state via the logic hash (95fb9924); 2210 tests green.

src/aacs/variant.rs

@@ -151,7 +151,7 @@ pub(crate) fn variant_key_data(records: &[MkbRecord]) -> Option<&[u8]> {
 // on) are shared with the classical walk in [`super::keys`] — a single
 // definition keeps the variant SD tree byte-identical to the classical one.
 // (`aesg3` itself is imported separately in the test module.)
-use super::keys::{calc_pk_from_dk, calc_v_mask};
+use super::media_key::{calc_pk_from_dk, calc_v_mask};
 
 /// Outcome of a subset-difference walk against an MKB. Carries the
 /// processing key and the matching `uv` slot — both needed as inputs
@@ -483,7 +483,7 @@ mod tests {
     // `use super::*` does not re-export the parent module's private `use`
     // imports, so pull them in directly for the tests below.
     use super::super::crypto::aesg3;
-    use super::super::keys::calc_pk_from_dk;
+    use super::super::media_key::calc_pk_from_dk;
 
     #[test]
     fn calc_pk_from_dk_terminates_on_nonconvergent_mask() {