Record the source, not the destination, in the FVI header

The `fvi://` arm of `output()` passed the destination `.fvi` path as
`FviSink::create`'s `source_path`, so every index named itself as its
own source. `SourceInfo::default()` supplied the rest, making
`source.medium` always "file" and `source.title` always 0 — three
header members wrong, where FVI_FORMAT.md §6.2 defines `source` as
describing the input.

Beyond the wrong data, it made the output unreproducible: two machines
indexing identical bytes emitted different files purely from where
they wrote them, and a local filesystem path leaked into a shareable
file.

`output()` cannot see the source, so thread the provenance down from
the driver, which can: `mux_stream` derives a `SourceInfo` per
`MuxInput` arm and passes it through `drive_mux` to `output()`. Per the
one-method-per-action rule this is a signature change, not an
`output_with_source()` variant; the parameter is `Option<&SourceInfo>`
so a caller with no provenance declares none rather than back-filling
the destination. `SourceInfo`/`Medium` become public API.

What each arm can honestly reach:

- Session: everything — device path, the caller's title index, the
  title's playlist, the scanned volume id.
- Url: the source URL, its scheme's medium, `title_index`, and the
  playlist off the opened stream's scanned title.
- Iso: the image path and playlist. The title index is not in
  `MuxInput::Iso` (it carries a scanned `DiscTitle`, which has no
  index), so it stays 0.
- Live: medium and playlist. The reader is an opaque
  `Box<dyn SectorSource>` with no path, and again no title index.

Unreachable members are left empty rather than guessed — the sink
already omits the empty ones.

src/mux/videomap.rs

@@ -126,8 +126,9 @@ impl Scan {
 
 /// Source `medium` for the header `source.medium` member
 /// (`docs/FVI_FORMAT.md` §6.2). Describes the physical/logical input the index
-/// was built from. The bare resolver path has no input-URL context, so it
-/// defaults to [`Medium::File`]; the CLI follow-up passes the real medium.
+/// was built from — never the destination the index is written to. The driver
+/// derives it from the `MuxInput` arm; [`Medium::File`] is the default only for
+/// a caller that declares no provenance at all.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
 pub enum Medium {
     Disc,