kona-safedb: land the SafeDB crate and integrate it into the ChainController

Land PR #21522's collapsed single crate (rocksdb-backed, kona's own format — no op-node DB compatibility; parity is at record semantics + RPC level). Integrate: write at local-safe promotion in the ChainController (`derived_from` supplies the L1 key), truncate on resets, serve `optimism_safeHeadAtL1Block` (currently deliberately MethodNotFound — reversed here; update comment + rpc/rollup.mdx), config flag. Choose the disabled-state error shape consciously (two consumers sniff it: rollupclient.go "not found" coercion; kona-sp1 fetcher matches -32601/"safedb").

Depends on: #22527 (controller write hook); the crate itself can land in parallel.

🤖 *Co-created with Claude (Fable 5)*

Start with PR #21522 and the ChainController write hook from dependency #22527, then trace local-safe promotion through derived_from and reset handling. Read rpc/rollup.mdx, rollupclient.go, and the kona-sp1 fetcher to compare expected disabled-state errors. Done means SafeDB is configurable, written and truncated at the specified points, and optimism_safeHeadAtL1Block is served with matching documentation and consumer behavior.

Written by the indexing model from the issue text.