Extract runtime key safety service route

[cbusillo]

Summary

• move runtime-key-safety policy apply request validation and route response handling into control_plane/runtime_key_safety_http.py
• keep service.py responsible for idempotency/app wiring while the runtime-key-safety route details live with the runtime-key-safety boundary
• reduce control_plane/service.py to 7,589 lines in this slice

Refs #307

Validation

• uv run python -m unittest tests.test_service.LaunchplaneServiceTests.test_runtime_key_safety_policy_endpoint_reconciles_rules tests.test_service.LaunchplaneServiceTests.test_runtime_key_safety_policy_endpoint_rejects_without_permission tests.test_runtime_key_safety
• uv run --extra dev ruff check --diff control_plane/service.py control_plane/runtime_key_safety_http.py
• uv run --extra dev ruff check control_plane/service.py control_plane/runtime_key_safety_http.py
• uv run --extra dev mypy control_plane/service.py control_plane/runtime_key_safety_http.py