KeydbSource owns keydb save + update

Move the keydb save/validation/atomic-write path out of libfreemkv onto
KeydbSource. New KeydbSource::save(bytes) validates + decompresses (zip /
gz / plain, decompressed-size capped) and crash-safely writes to the
source's OWN path (sibling-temp + fsync + rename + parent-dir fsync) —
not a hardcoded default, so the caller chooses the destination.
KeydbSource::update(fetch, url) calls an INJECTED fetch closure then
save, keeping this crate transport-agnostic on the update path (the app
supplies its own TLS / SSRF-guarded transport). UpdateResult moves here
and is re-exported. Add flate2 + zip (already in the resolved graph via
libfreemkv) for decompression; no new HTTP stack.

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## [1.1.0-beta.1] — UNRELEASED
 
+### Added
+
+- `KeydbSource` now owns keydb save + update (atomic write to the source's own
+  path); honors the caller-supplied location.
+
 ### Fixed
 
 - **Processing-Key decryption restored.** A keydb Processing Key is again driven