Fix Xiaomi CS2 audio payload writes

[RuiFG]

Summary

• copy the encrypted audio payload into Xiaomi CS2 media packets
• add a regression test that verifies both the media header and payload on the wire

Root cause

WritePacket allocates space for hdrSize + len(payload), but the second copy used hdr again. As a result, the camera received encrypted media-header bytes followed by zero padding instead of the encrypted Opus payload, which produced extremely loud static during two-way audio.

User impact

This restores the speaker payload for Xiaomi cameras using the MISS/CS2 transport. The fix was verified end-to-end with xiaomi.camera.083ac1 on go2rtc 1.9.14 through Scrypted and HomeKit; two-way audio works after applying this change.

Fixes #2175.

Validation

• go test ./pkg/xiaomi/miss/cs2
• go test ./pkg/xiaomi/miss/...
• go build -trimpath .
• manual end-to-end test on xiaomi.camera.083ac1

go test ./... was also run on Windows; unrelated existing failures remain in FFmpeg expectations and platform/build-tag-dependent packages. The focused Xiaomi CS2 tests pass.