Audit fixes + DVD support foundation (IFO, PS demux, MPEG-2, CSS crack)

Audit fixes (14 critical, 22 warnings):
- UDF: bounds checks on all ICB/FID parsing from disc data
- SCSI Linux: saturating_sub on residual, CDB length guard, buffer size guard
- SCSI macOS: SCSITaskStatus u32 (was u8 — stack corruption)
- AACS: EC mod_inv returns infinity instead of panic, key reduced mod n
- AACS: do_handshake tries all host certs (was returning on first failure)
- H.264: bounds check on SPS < 4 bytes
- ContentReader: error on missing unit key (was zero-fill)
- KEYDB: flat redirect loop (was recursive), 100MB response limit, Windows HOME fallback
- ISO writer: AVDP extent order, partition length, allocation cap
- Network: removed TCP_NODELAY on bulk stream
- MKV: guard on u64::MAX seek
- disc.rs: saturating_sub on extent offset, simplified dead region code
- cargo fmt (610 violations), cargo clippy --fix (55 auto-fixes)

DVD support (new files):
- src/ifo.rs — IFO parser (VIDEO_TS.IFO, VTS_XX_0.IFO, PGC chains, cells, streams) — 13 tests
- src/mux/ps.rs — MPEG-2 Program Stream demuxer (pack headers, PES, private stream 1) — 12 tests
- src/mux/codec/mpeg2.rs — MPEG-2 video parser (sequence headers, I-frame detection) — 15 tests
- src/css/crack.rs — split-attack algorithm (LFSR cipher needs verification — test ignored)

226 tests total (was 186), 1 ignored (CSS crack needs cipher verification).

src/drive/unix.rs

@@ -7,7 +7,9 @@ pub fn find_drives() -> Vec<(String, DriveId)> {
     let mut drives = Vec::new();
     for i in 0..16 {
         let path = format!("/dev/sg{}", i);
-        if !std::path::Path::new(&path).exists() { continue; }
+        if !std::path::Path::new(&path).exists() {
+            continue;
+        }
         if let Ok(mut transport) = crate::scsi::open(std::path::Path::new(&path)) {
             if let Ok(id) = DriveId::from_drive(transport.as_mut()) {
                 if !id.raw_inquiry.is_empty() && (id.raw_inquiry[0] & 0x1F) == 0x05 {
@@ -22,7 +24,9 @@ pub fn find_drives() -> Vec<(String, DriveId)> {
 pub fn resolve_device(path: &str) -> Result<(String, Option<String>)> {
     if path.contains("/sg") {
         if !std::path::Path::new(path).exists() {
-            return Err(Error::DeviceNotFound { path: path.to_string() });
+            return Err(Error::DeviceNotFound {
+                path: path.to_string(),
+            });
         }
         return Ok((path.to_string(), None));
     }
@@ -36,17 +40,24 @@ pub fn resolve_device(path: &str) -> Result<(String, Option<String>)> {
                 && sg_id.serial_number == sr_id.serial_number
             {
                 let warning = format!(
-                    "{} is a block device (sr) — using {} (sg) for raw access", path, sg_path
+                    "{} is a block device (sr) — using {} (sg) for raw access",
+                    path, sg_path
                 );
                 return Ok((sg_path, Some(warning)));
             }
         }
-        return Ok((path.to_string(), Some(format!(
-            "{} is a block device (sr) — no matching sg device found", path
-        ))));
+        return Ok((
+            path.to_string(),
+            Some(format!(
+                "{} is a block device (sr) — no matching sg device found",
+                path
+            )),
+        ));
     }
     if !std::path::Path::new(path).exists() {
-        return Err(Error::DeviceNotFound { path: path.to_string() });
+        return Err(Error::DeviceNotFound {
+            path: path.to_string(),
+        });
     }
     Ok((path.to_string(), None))
 }