Matthew Jackson
17fcf6d8f9
Move the keydb save/validation/atomic-write path out of libfreemkv onto KeydbSource. New KeydbSource::save(bytes) validates + decompresses (zip / gz / plain, decompressed-size capped) and crash-safely writes to the source's OWN path (sibling-temp + fsync + rename + parent-dir fsync) — not a hardcoded default, so the caller chooses the destination. KeydbSource::update(fetch, url) calls an INJECTED fetch closure then save, keeping this crate transport-agnostic on the update path (the app supplies its own TLS / SSRF-guarded transport). UpdateResult moves here and is re-exported. Add flate2 + zip (already in the resolved graph via libfreemkv) for decompression; no new HTTP stack.