[defisym]

FFMpeg previously loaded an encrypted video's complete plaintext before playback. This PR connects the independent DecryptReader from #91 to the existing MemBuf/AVIO path so uncached encrypted assets can be read and sought on demand.

Depends on #91. The temporary base is codex/portable-encryption-sample, so this PR displays only the MemBuf/AVIO change and its compatibility follow-ups. Merge #91 first, then retarget/rebase this PR onto master as needed. The portable Encryption implementation, shared Unicode utilities and native analyzer fixes are reviewed in #91.

Changes

• MemBuf remains the simple memory implementation and base class, with virtual read/seek/clone.
• Plugin-side DecryptMemBuf receives an existing decryption context and forwards read/seek; the reusable encryption core has no FFmpeg types or includes.
• The event bridge creates the decryption context only for uncached encrypted assets. Existing files/URLs, pointer/size memory and explicit caching keep their existing paths.
• FFMpeg retains AVIO allocation, init_probe, format opening and cleanup. Probe uses av_probe_input_buffer2 and preserves probe bytes for later demuxing.
• The optional FFMpegOptions::input is a shared_ptr prototype. Playback/preview clone independent cursors and own separate AVIO contexts. Default file/URL input creates no custom MemBuf/AVIO.
• The original file/options and memory constructors remain. A private options-only delegate handles cleanup when construction fails. Grab-frame initialization retains the existing boolean error handling without a blanket catch.
• Existing Debug/compiler/linker settings are preserved.
• Core and KeyGen includes and native AVIO tests follow Encryption: portable core, KeyGen and existing asset compatibility #91's new Encryption/ module layout; the encryption implementation remains outside this PR.
• No extra general input interface or AVIO wrapper is introduced. Existing Fusion action/expression parameters remain unchanged.

Validation

• Local CMake Release and sanitizer suites passed for memory/encrypted WAV demuxing, explicit probing, exact payload bytes, size/seek bounds, independent previews and IO error translation.
• A local harness compiled the actual FFMpeg probe/open/cleanup functions and verified identical full JPEG payloads from the original and old encrypted sample, plus invalid-probe cleanup.
• After syncing the shared Unicode utilities from Encryption: portable core, KeyGen and existing asset compatibility #91, the complete core and AVIO suites passed again under ASan/UBSan. The event bridge uses std::filesystem::path directly and keygen::from_wide.
• Core and old-asset compatibility coverage belongs to Encryption: portable core, KeyGen and existing asset compatibility #91. Native AVIO tests do not establish that the complete Fusion plugin has been built/run on Windows.

Manual acceptance

• Build the FFMpeg extension with VS and load it in Fusion.
• Play and seek a large encrypted video without caching; verify memory usage remains bounded.
• Grab frames while playback seeks and confirm independent positions.
• Check ordinary files/URLs, pointer/size memory, explicit caching and hardware/codec fallback.

After #91 merges, update this PR's base to master before final merge.