This is a long shot, but has anyone used the Helix AAC decoder?  I do
and it works great, but I'm annoyed that it hardcodes zero as the
reported bitrate.  Has anyone figured this out?  I haven't even had any
luck figuring out how to extract the bitrate from an AAC stream.

I have used it, see http://embdev.net/articles/ARM_MP3/AAC_Player.

I'm afraid I can't really you with your question, but I'll try. I think
that in MP3, the bitrate is directly coded in the frame header, and
that's where Helix gets it from. In AAC, there is no such field in the
header, at least not for all stream formats; you might have to calculate
it from the frame size yourself.