feat: add AES-128-CBC decryption and clap CLI (M4)

Add session key derivation and payload decryption using AES-128-CBC
with well-known XEX2 master keys. Refactor CLI to use clap with
inspect/extract subcommands. Extend FileFormatInfo to parse
compression metadata (basic blocks, LZX window size/block chain).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/display.rs

@@ -1,7 +1,7 @@
 /// Pretty-print formatting for parsed XEX2 structures.
 use crate::header::Xex2Header;
 use crate::optional::{
-    format_hex_bytes, format_rating, format_timestamp, HeaderKey, OptionalHeaders,
+    format_hex_bytes, format_rating, format_timestamp, CompressionInfo, HeaderKey, OptionalHeaders,
 };
 use crate::security::SecurityInfo;
 
@@ -79,6 +79,25 @@ pub fn display_optional_headers(headers: &OptionalHeaders) {
         println!("[FILE_FORMAT_INFO]");
         println!("  Encryption:  {}", fmt.encryption_type);
         println!("  Compression: {}", fmt.compression_type);
+        match &fmt.compression_info {
+            CompressionInfo::Basic { blocks } => {
+                println!("  Blocks:      {} basic compression blocks", blocks.len());
+            }
+            CompressionInfo::Normal {
+                window_size,
+                first_block,
+            } => {
+                println!(
+                    "  Window Size: 0x{window_size:X} ({} KB)",
+                    window_size / 1024
+                );
+                println!(
+                    "  First Block: {} bytes",
+                    first_block.block_size
+                );
+            }
+            _ => {}
+        }
     }
 
     // Checksum + timestamp